build: migrate from npm to pnpm

Ten git worktrees each carried their own 225 MB node_modules (1.1 GB across
five) and paid 11s per `npm ci`. pnpm hardlinks from a shared store: the same
five worktrees cost ~250 MB total, and a fresh install is 4s.

What changed beyond the mechanical rename:

- `overrides` moved to `pnpm-workspace.yaml`. pnpm 11 does not read the `pnpm`
  field in package.json *or* npm's top-level `overrides`, and it fails silently
  — the vite/defu/language-server pins would have quietly stopped applying.
- Build scripts are blocked by default in pnpm; esbuild and sharp are allowed
  explicitly via `allowBuilds` (renamed from `onlyBuiltDependencies` in 11).
- `packageManager` + `engines` pin the toolchain.
- gate.sh rejects a package-lock.json/yarn.lock/bun.lock outright, so an agent
  running `npm install` out of habit fails loudly instead of building a second,
  divergent dependency tree.
- CI bootstraps pnpm with `npm install --global pnpm@11.25.0` rather than
  corepack (unbundled as of Node 25) or pnpm/action-setup (this self-hosted
  act-runner has never run a job; fetching a third-party action is not
  something to discover on the first one).

Two pre-existing CI bugs fixed while in the file:

- the gate installed with `npm install --package-lock=false`, which discarded
  the lockfile the previous session had just fixed.
- the visual-regression step imported `playwright`, which is not a dependency,
  and `visual-regression.mjs` has no compare mode anyway — in CI it overwrote
  its own baselines and passed unconditionally. Removed with a comment; it
  comes back when it can diff.

The `publish` job is now manual (`workflow_dispatch`). During the migration
dist/ holds three HTML files against the live pages branch's ten, so publishing
on every push to main would take the site down to a stub. Restore at task 20.

HANDOVER.md's incident log still says npm where it describes what happened at
the time; that is history, not a missed rename.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/operations-guide.md

@@ -25,7 +25,7 @@ worktree practices taught by the presentation fit together.
 | Local checkout         | `/home/marcos/Projects/ai-for-dummies`                                                                                     |
 | Source branch          | `main`                                                                                                                     |
 | Published branch       | `pages`                                                                                                                    |
-| Local verification     | `npm run verify`                                                                                                           |
+| Local verification     | `pnpm run verify`                                                                                                          |
 | SilverBullet page      | `Guides/AI For Dummies Presentation`                                                                                       |
 | Skills-review vote API | `vote-service/` — separate pod, see `vote-service/README.md`                                                               |
 
@@ -51,7 +51,7 @@ migration task.
 
 ```mermaid
 flowchart LR
-  E[Edit main] --> V[npm run gate]
+  E[Edit main] --> V[pnpm run gate]
   V --> C[Commit]
   C --> P[Push main]
   P --> G[Gitea Actions: gate + build]
@@ -76,7 +76,7 @@ part of the published site.
 ### 2. Preview locally
 
 ```bash
-npm run dev
+pnpm run dev
 ```
 
 Open
@@ -88,7 +88,7 @@ least one desktop and one mobile viewport. The production site is under the
 ### 3. Verify before committing
 
 ```bash
-npm run gate
+pnpm run gate
 ```
 
 The gate runs Astro types and build checks, content contracts, the runtime
@@ -120,8 +120,8 @@ If the runner is unavailable, use the following manual fallback from a clean
 `main` checkout. It deliberately replaces the generated branch tree only:
 
 ```bash
-npm install --package-lock=false --prefer-offline
-npm run build
+pnpm install --frozen-lockfile
+pnpm run build
 git worktree add /tmp/ai-for-dummies-pages --detach pages
 git -C /tmp/ai-for-dummies-pages rm -rf .
 cp -a dist/. /tmp/ai-for-dummies-pages/
@@ -523,7 +523,7 @@ ordinary content recovery.
 - [ ] Portuguese static and dynamic copy is complete.
 - [ ] Mouse and keyboard interactions work.
 - [ ] Full HD, 4K, and mobile layouts remain readable.
-- [ ] `npm run verify`, `node --check app.js`, and `git diff --check` pass.
+- [ ] `pnpm run verify`, `node --check app.js`, and `git diff --check` pass.
 - [ ] `main` is pushed.
 - [ ] `pages` fast-forwards to the same commit.
 - [ ] Live endpoint returns HTTP 200 and contains the new section.