fix(ci): pin pnpm@9 to unblock publish

[shrinishLT]

Problem

The v4.1.80 publish failed:

Error: ERR_PNPM_IGNORED_BUILDS
  × installing dependencies
  ╰─▶ Ignored build scripts: @playwright/browser-chromium@1.54.2,
      @playwright/browser-firefox@1.54.2, @playwright/browser-webkit@1.54.2,
      esbuild@0.27.7, sharp@0.33.5

Cause

release.yaml installs pnpm unpinned:

- run: rm -rf pnpm-lock.yaml
- run: npm install -g pnpm      # ← always latest
- run: pnpm install

pnpm 10 turned ignored build scripts from a warning into a hard error. v4.1.79 published successfully on Aug 10; pnpm 10 landed between then and now, so the next publish was going to fail regardless of its contents — v4.1.80 was simply the first one cut. (The v4.1.72/v4.1.73 failures on Jul 22 are unrelated; a green v4.1.74 followed the same day.)

Fix

Pin pnpm@9 — the version that generated the committed lockfile (lockfileVersion: '9.0') and produced every successful publish to date. pnpm 9 runs build scripts by default, which all five blocked packages require:

package	postinstall
sharp	links the libvips native binary
esbuild	downloads the platform binary
@playwright/browser-{chromium,firefox,webkit}	download the browsers

One line; package.json is untouched.

Why not pnpm.onlyBuiltDependencies

Considered and deliberately left out. Once that allowlist exists, pnpm 10 silently skips build scripts for any package not in the list — so a future dependency needing one would break quietly, instead of failing loudly as it did here. The loud error is worth keeping as a signal; the unpinned install is the actual root cause.

Release state

4.1.80 is not on npm (latest published is 4.1.79) — the failed run never reached the publish step. So no version bump is needed: stage stays on 4.1.80 and that version is still free.

Order: merge this → re-run / re-cut v4.1.80 → then #554 (stage -> prod).

🤖 Generated with Claude Code