Add GraphQL to the pnpm workspace and unify dependency metadata

[dahlia]

Problem

The Deno workspace includes graphql, but the pnpm workspace does not and graphql/package.json is missing. Dependency versions are maintained separately in the Deno import map and pnpm catalog, with observable drift between them.

Tasks

• Add graphql/package.json and include the package in the pnpm workspace.
• Declare every GraphQL runtime and development dependency explicitly.
• Make the pnpm catalog the authoritative dependency-version source.
• Align workspace package exports and development dependencies.
• Decide how JSR dependencies are consumed from Node.js without maintaining a second version catalog.
• Add checks that catch undeclared imports and workspace dependency cycles.
• Keep a temporary Deno compatibility path only for as long as the staged migration requires it.

Acceptance criteria

• pnpm can install and resolve every maintained package, including graphql, from a clean checkout.
• Dependency versions have one authoritative definition.
• Package manifests match actual imports.
• Existing Deno checks continue to pass during the transition.
• The Node.js validation issue can run without relying on Deno's workspace resolver.

AI assistance: This issue was drafted and organized with Codex after a maintainer-led code audit.