build: refresh pnpm lockfile and pin build approvals

Coolify builds were failing with ERR_PNPM_OUTDATED_LOCKFILE because
the devDependencies added in recent commits (eslint, playwright,
@astrojs/check, tsx, sharp, etc.) had been installed with npm locally
and the pnpm-lock.yaml in the repo was stale.

- Regenerate pnpm-lock.yaml from current package.json.
- Promote sharp to a direct devDependency (scripts/build-og-image.ts
  imports it; pnpm cannot resolve transitive packages outside the
  importer graph).
- Pin esbuild and sharp as allowed build scripts in pnpm-workspace.yaml
  so pnpm 11's default deny policy does not skip their native postinstall
  on a clean install. Both are required: esbuild for the Vite/Astro
  binary, sharp for the OG image rasterizer.
- Add a pnpm engine pin (>=9) so installs that target the new schema
  fail fast instead of silently downgrading.

Verified locally: pnpm install (clean), pnpm run prebuild (regenerates
OG images, astro check, eslint), pnpm run build and pnpm run test:e2e
all pass (20/20).

.npmrc

@@ -0,0 +1,2 @@
+auto-install-peers=true
+node-linker=isolated

package.json

@@ -4,7 +4,8 @@
   "version": "0.1.0",
   "private": true,
   "engines": {
-    "node": ">=22.12.0"
+    "node": ">=22.12.0",
+    "pnpm": ">=9"
   },
   "scripts": {
     "dev": "astro dev",
@@ -39,6 +40,7 @@
     "eslint": "^9.39.5",
     "eslint-plugin-astro": "^3.0.1",
     "eslint-plugin-jsx-a11y": "^6.10.2",
+    "sharp": "^0.34.0",
     "tsx": "^4.23.1",
     "typescript": "^5.6.3",
     "typescript-eslint": "^8.65.0"

pnpm-workspace.yaml

@@ -1,2 +1,8 @@
 packages:
   - .
+allowBuilds:
+  esbuild: true
+  sharp: true
+onlyBuiltDependencies:
+  - esbuild
+  - sharp