Fix Docker build: move onlyBuiltDependencies to pnpm-workspace.yaml, pin pnpm@10

pnpm 10 no longer reads the "pnpm" field in package.json and treats
ignored build scripts as a hard error (ERR_PNPM_IGNORED_BUILDS), which
broke `pnpm install --frozen-lockfile` in the Docker build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -6,7 +6,7 @@ FROM node:22-alpine AS client-builder
 WORKDIR /build
 
 # Install pnpm
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN corepack enable && corepack prepare pnpm@10 --activate
 
 # Copy workspace manifests first for better layer caching
 COPY pnpm-workspace.yaml package.json pnpm-lock.yaml* ./
@@ -29,7 +29,7 @@ FROM node:22-alpine AS server-builder
 
 WORKDIR /build
 
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN corepack enable && corepack prepare pnpm@10 --activate
 
 COPY pnpm-workspace.yaml package.json pnpm-lock.yaml* ./
 COPY apps/server/package.json ./apps/server/
@@ -51,7 +51,7 @@ FROM node:22-alpine AS runtime
 # Install tini for proper PID 1 signal handling
 RUN apk add --no-cache tini su-exec
 
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN corepack enable && corepack prepare pnpm@10 --activate
 
 WORKDIR /app
 

package.json

@@ -9,8 +9,5 @@
   },
   "devDependencies": {
     "concurrently": "^8.2.2"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": ["esbuild"]
   }
 }

pnpm-workspace.yaml

@@ -1,2 +1,5 @@
 packages:
   - 'apps/*'
+
+onlyBuiltDependencies:
+  - esbuild