fix(ci): bump pnpm to 10.34.5 for npm OIDC trusted publishing

[prosdev]

Problem

The Release job failed at changeset publish:

error an error occurred while publishing @prosdevlab/kero: EUNKNOWNCONFIG Unknown cli flag:
  - --git-checks
error npm error code EUNKNOWNCONFIG

Both @prosdevlab/dev-agent@0.13.0 and @prosdevlab/kero@1.0.0 failed to publish. The version bump was already committed — only the npm push failed.

Root cause

The workflow uses npm OIDC trusted publishing (no NPM_TOKEN), which requires npm >=11.5.1 — CI installs it via npm install -g npm@latest. changeset publish runs pnpm publish --no-git-checks, but pnpm 8.15.4 is not OIDC-aware: its publish path delegates to the npm binary and leaks the pnpm-only --no-git-checks flag through to npm 11, which rejects it. Every package fails.

Fix

Change	Why
packageManager -> pnpm@10.34.5	Native OIDC trusted publishing; handles --no-git-checks correctly. Stays on 10.x — pnpm 11 has an OIDC regression (pnpm#11513).
Regenerate pnpm-lock.yaml (v6.0 -> 9.0)	Required by the pnpm major bump.
onlyBuiltDependencies: [@parcel/watcher, esbuild] in pnpm-workspace.yaml	pnpm >=10 blocks dependency build scripts by default; these two are the only deps in the tree with build scripts (tree-sitter is WASM, no native build).
Pin vite ^7.1.12 (root devDep)	The lockfile regen floated root vitest to 4.1.10, whose vite peer wrongly resolved to 5.x and broke the test runner. The pin restores the vitest 4 + vite 7 pairing the old lockfile had. Load-bearing — removing it re-breaks pnpm test.

release.yml needs no change — pnpm/action-setup@v5 reads the packageManager field.

Verification (all under pnpm 10.34.5)

• pnpm build — 8/8
• pnpm typecheck — 6/6
• pnpm test — 1819 passed, 39 skipped
• pnpm install --frozen-lockfile — CI parity

Merge gate

OIDC has no NPM_TOKEN fallback. Before merging, confirm a trusted publisher is configured on npmjs.com for BOTH published packages (@prosdevlab/dev-agent and @prosdevlab/kero), each pointing at this repo + release.yml. If either is missing, that package's publish fails at release time with no fallback.

Optional follow-ups (not in this PR)

• Pin the npm floor in release.yml: npm install -g npm@^11.5.1 instead of @latest, so a future npm major can't change OIDC/CLI behavior non-deterministically.
• Centralize the cross-package vitest/vite version drift (1.x / 2.x / 4.x) via a pnpm catalog (pre-existing, out of scope).

🤖 Generated with Claude Code