Migrate from npm to pnpm workspaces

[sleeyax]

Replaces npm workspaces with pnpm, using pnpm's default strict isolated node_modules layout.

What changed

• pnpm-workspace.yaml replaces the root workspaces array. pnpm 11 gates dependency build scripts behind allowBuilds: esbuild/workerd are allowed for wrangler, ssh2/cpu-features denied since they're optional native speedups for beamup-cli's SSH transport and it falls back to pure JS.
• Package manifests — internal deps are now workspace:*, and typescript/@types/node/vitest/tsx/cross-env are declared in the packages that actually use them instead of being borrowed from the root via npm's flat hoisting. files: ["dist"] was added to api and addon, and the deprecated prepublish hook became prepublishOnly.
• Dockerfile — installs with pnpm install --frozen-lockfile --filter "@easynews/addon..." (so the worker's toolchain stays out of the image), then pnpm deploy collects the addon plus its workspace deps into one self-contained directory. The final image is a plain node dist/server.js and needs no package manager at runtime. New .dockerignore too, since there wasn't one and COPY packages/... was dragging in whatever the host had.
• CI — pnpm/action-setup@v4 before setup-node so cache: 'pnpm' can find the binary.
• Node unified on 24 across engines, the Dockerfile and CI, which previously said 20, 22 and 23 respectively.
• Drops the stale empty .yalc/ tree (no yalc.lock, no file:/link: deps anywhere) and adds a .prettierignore so pnpm format stops reformatting the lockfile that pnpm rewrites on every install.

Notes

forceLegacyDeploy: true is set in pnpm-workspace.yaml because pnpm deploy otherwise requires injectWorkspacePackages: true, which would replace the workspace symlinks with copies and break live local development against @easynews/api.

Verified

• Clean pnpm install --frozen-lockfile -> pnpm build -> 20/20 tests pass
• pnpm start:addon and pnpm start:addon:dev both serve /manifest.json
• pnpm start:cloudflare-worker:dev bundles the linked addon and serves the manifest
• docker build --no-cache succeeds; the container serves /manifest.json (167 MB image)
• pnpm pack on the addon produces a tarball containing dist/
• pnpm version patch propagates to all four manifests and stages them

Not verified: the actual beamup deploy. beamup is Dokku, which prefers a root Dockerfile over buildpacks, so it should go through the updated Dockerfile — but that only proves out on a real pnpm deploy:beamup.