Fix remaining pnpm 11 audit handling

[miguelcalderon]

Summary

• Pin pnpm 11.20.0 with a tamper-evident packageManager hash, and take the pnpm version from it in both workflows instead of an action input.
• Move the root pnpm configuration to pnpm-workspace.yaml (overrides plus allowBuilds/onlyBuiltDependencies) and set verifyDepsBeforeRun: warn so pnpm run never installs implicitly.
• Guard every pnpm example with require_local_pnpm_workspace: a pnpm-lock.yaml without a sibling pnpm-workspace.yaml fails loudly instead of silently binding to the root workspace.
• Make pnpm audit/install failures visible and nonzero through shared helpers (scripts/pnpm-helpers.sh); install-dependencies.sh and the automated bump now fail fast instead of skipping later examples, while the aggregate audit script reports all failures and exits 1.
• pnpm audit --fix=override is now a real operation instead of the previous invalid, ignored subcommand. Automated SDK bumps can therefore include security overrides in each pnpm example's pnpm-workspace.yaml and corresponding lockfile updates; generated bump PRs disclose this explicitly.
• Set minimumReleaseAge: 0 in both pnpm example workspaces and export the same policy from their shared scripts, so automated writers, CI, and direct pnpm install calls consistently accept newly released SDK and transitive versions without writing minimumReleaseAgeExclude entries.
• Playwright CI installs pnpm, runs tests/pnpm-workflows.test.sh, and installs the pnpm examples. Root-level scripts, the husky hook, README, AGENTS.md and the PR template use pnpm; COREPACK_ENABLE_STRICT=0 is set where the scripts and the Playwright web server run npm inside the npm-based examples.

Validation

• tests/pnpm-workflows.test.sh, including executable fail-fast/error fixtures and direct-workspace release-age assertions
• Root, SvelteKit, and Vue Composition API frozen pnpm installs with pnpm 11.20.0; both example installs pass with the release-age environment override unset
• SvelteKit and Vue Composition API production builds with pnpm 11.20.0
• Fixtures against pnpm 11.20.0: the ancestor-workspace all-zero audit reproduced without the guard; minimumReleaseAgeExclude writes reproduced and suppressed by the env opt-out; the Corepack npm rejection from examples/react reproduced and lifted by COREPACK_ENABLE_STRICT=0
• Biome, shellcheck, bash -n, and git diff checks

[ritz078]

Requesting changes on one item — the packageManager pin and the version: 10 in update-nutrient-sdk.yml need to land reconciled, details inline.

Worth flagging separately because it has no line to hang on: the green checks here don't cover any of this. playwright.yml installs no pnpm, and the run on this head logs ./scripts/install-dependencies.sh: line 13: pnpm: command not found for both pnpm examples; neither changed script is referenced by any workflow at the merge base. So no pnpm code path in this PR is exercised by PR CI, and the first real execution will be the scheduled bump job.

The underlying problem is real and the fix is the right one, for what it's worth — I verified a root pnpm install --frozen-lockfile fails on the pre-PR shape (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH) and passes on this one, with the existing v9 lockfile unchanged.

[miguelcalderon]

@nutrient-core-reviewer review

[ritz078]

One thing with no line to hang on: the description doesn't mention install-dependencies.sh gaining set -euo pipefail. It's a real behaviour change — the first failing example now ends the run instead of being skipped — and it's what turns the release-age inconsistency below into a dead Playwright job rather than one uninstalled example. Defensible as fail-fast, worth stating as a deliberate call.

Approving on the strength of the rest: I verified the packageManager hash against the registry's dist.integrity, and CI on this head genuinely exercises the pnpm path for the first time.