pnpm v10 blocks dependency build/postinstall scripts by default and
requires interactive 'pnpm approve-builds' to whitelist them, which
is not usable in CI. Declare esbuild as an allowed build in both
pnpm-workspace.yaml (canonical location since pnpm 10.7) and
package.json (legacy/parity) so installs run non-interactively.