Move pnpm to its current major once Dependabot supports it #153

The workspace pins pnpm 10 in the packageManager field, the newest major Dependabot officially supports (ADR-0152). pnpm 12 is current. It is a native executable and can also provision Node itself (devEngines.runtime, the pnpm/setup action), locking both versions with checksums in pnpm-lock.yaml. That would replace NVS, actions/setup-node, and the AppHost's NVS lookup with one pin. It cannot land yet: Dependabot reads pnpm 12's multi-document lockfile as an empty dependency graph and stops raising security updates (dependabot-core#15904), does not officially support pnpm 11 or 12 (dependabot-core#16397), and ignores devEngines (dependabot-core#13722). When it supports them, bump packageManager by hand (Dependabot never does, dependabot-core#4830), regenerate the lockfile, decide whether devEngines.runtime replaces .node-version as the single Node pin, and keep strictDepBuilds with the reviewed allowBuilds list. Touch points: src/frontend/package.json, pnpm-workspace.yaml, pnpm-lock.yaml, .github/workflows/frontend.yml, .github/workflows/copilot-setup-steps.yml, build/frontend-install.ps1, the AppHost's EnsurePinnedNodeOnPath.