Keep pnpm-lock.yaml a single document so Dependabot sees dependencies

[mpsq]

pnpm 12 writes its own pinned version as a first YAML document in pnpm-lock.yaml. GitHub's dependency graph reads only that document, so the SBOM dropped to direct dependencies and Dependabot auto-closed alerts as "fixed" while the vulnerable versions were still locked (dependabot/dependabot-core#15904).

• Set pmOnFail: ignore in pnpm-workspace.yaml so pnpm stops writing that document
• Drop the existing env document from pnpm-lock.yaml; the dependency document is unchanged byte for byte
• CI installs the pinned pnpm through pnpm/setup, which reads packageManager, so CI is unaffected. Locally, pnpm no longer auto-switches to the pinned version

---

Note

Low Risk
Lockfile and workspace config only; restores correct SBOM/Dependabot visibility with no application or runtime behavior changes.

Overview
Fixes Dependabot and GitHub’s dependency graph by keeping pnpm-lock.yaml as a single YAML document instead of pnpm 12’s leading “package manager only” block.

Adds pmOnFail: ignore in pnpm-workspace.yaml (with a short comment linking dependabot-core#15904) so pnpm stops re-inserting that first document. Removes the existing env/pm pin document from pnpm-lock.yaml; the dependency lock content is unchanged. packageManager in package.json still pins pnpm for CI via pnpm/setup; locally, pnpm no longer auto-switches to the pinned version when the lockfile doc is gone.

^{Reviewed by Cursor Bugbot for commit 7b6fe40. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no concrete failure was found.

_{Reviews (1) · Last reviewed commit: "Keep pnpm-lock.yaml a single document so..." · Reviewed by Greptile}