fix(ci): use pnpm 11 allowBuilds syntax and pin pnpm version

The previous fix (#119) used `onlyBuiltDependencies` in pnpm-workspace.yaml,
but the CI runner resolved `version: latest` to pnpm 11.1.2, where that key
was removed and replaced by `allowBuilds` (a map of name -> bool). The
`pnpm.onlyBuiltDependencies` block in package.json doesn't apply at the
workspace level either, so esbuild was still being ignored.

Changes:
- pnpm-workspace.yaml: replace `onlyBuiltDependencies: [esbuild]` with
  `allowBuilds: { esbuild: true }` (pnpm 11 syntax).
- package.json: add `packageManager: pnpm@11.1.2` so the version is
  reproducible across CI and local; drop the now-dead `pnpm` block.
- .github/workflows/build.yml: drop `version: latest` from
  pnpm/action-setup; the action reads the version from `packageManager`.

.github/workflows/build.yml

@@ -13,8 +13,7 @@ jobs:
 
    - name: Install pnpm 📥
      uses: pnpm/action-setup@v4
-     with:
-      version: latest
+     # Version is read from `packageManager` in package.json for reproducible builds.
 
    - name: Install Node.js 📥
      uses: actions/setup-node@v4