CI workflows:
- All jobs add a pnpm/action-setup@v4 step before setup-node so the
  node cache uses the pnpm store. pnpm version is sourced from
  package.json `packageManager` field.
- yarn install --frozen-lockfile -> pnpm install --frozen-lockfile
- commitlint job invokes the CLI via `node @commitlint/cli/cli.js`
  because pnpm's strict layout does not symlink workspace binaries
  to the root node_modules/.bin/ (matches the .husky/commit-msg
  pattern).
- baseline-apt job installs Node from apt and pnpm via corepack
  (corepack ships with Node >=16.10).

Dockerfiles:
- Dockerfile.ci and Dockerfile.dev enable corepack and call pnpm.
- npm pack of the published @commitlint/* packages is unchanged
  (it fetches from the registry, independent of the local lockfile).

Docs:
- README and CONTRIBUTING switched to pnpm commands.
- CONTRIBUTING adds an admonition for contributors with pre-pnpm
  local clones: a one-time node_modules cleanup and pointers to
  mise / corepack / direct pnpm install.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

@commitlint/load and @commitlint/top-level have pkg/deps scripts that
invoke the pkg-check / dep-check binaries provided by
@packages/utils (published name: @commitlint/utils) but neither
package listed it as a devDependency. Resolves today only because
yarn classic hoists the binary to the root; under pnpm's strict
layout it is not visible from the workspace.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The hardcoded `yarn pack --filename` invocation in pkg-check fails
without yarn on PATH. Switch to `pnpm pack --pack-destination` and
parse the produced filename from stdout — pnpm prints the absolute
path of the tarball, so the basename is joined with the temp dir
we passed as the destination.

Note: pkg-check is invoked manually at release time, not in CI.
The PRELUDE-based import test has separate pre-existing issues
under pnpm's tarball contents; addressing those is out of scope
for this commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Three additions to .npmrc, each defensive against a different
failure class:

- strict-dep-builds=true: turn the "unapproved install script"
  warning into a hard error. A new transitive dep that ships a
  postinstall now blocks install until someone explicitly decides
  whether to allow it in pnpm-workspace.yaml's allowBuilds.

- verify-deps-before-run=error: refuse to run pnpm scripts when
  node_modules diverges from the lockfile. Catches the "edited
  package.json, forgot to reinstall" class of drift.

- resolution-mode=time-based: when resolving a version range,
  prefer the version that was current as of the most-recent direct
  dep publish. Limits exposure to a compromised brand-new release
  of a transitive dep.

All three are config-only; the existing lockfile and node_modules
state already satisfy them, so install + build + test pass
unchanged (1188/1188).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

@commitlint/test-environment no longer exists — the package was
renamed to vitest-environment-commitlint. Renovate was silently
ignoring nothing; rename the entry so the internal-package safety
net actually covers it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- Rename the deprecated config:base preset to config:recommended
  (renovate's recommended modern equivalent).
- Enable lockFileMaintenance with a weekly Monday-morning schedule.
  Pairs with resolution-mode=time-based: the periodic refresh becomes
  the explicit moment new transitive versions get adopted, instead of
  drifting in on each direct-dep range bump.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Replace the exact node = "22.12.0" pin (rejects auto-bumped patch
releases) with the broader node = "22" plus engine-strict=true in
.npmrc. mise serves the latest 22.x stable (currently well above
22.12), and pnpm now hard-fails install when engines.node /
engines.pnpm aren't met — turning those fields from soft advisories
into real floors.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Same reasoning as the node = "22" relaxation: the exact in-project
pnpm version is already enforced by the packageManager field +
corepack + engines.pnpm + engine-strict. mise just needs "some
modern 11.x", not a specific patch. Removes the false-positive
"missing: pnpm@11.1.0" warning when contributors already have
another 11.x installed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pnpm 11.1.0 requires Node >=22.13. action-setup@v4 runs on a bundled
Node 20, so its `npm install -g pnpm@11.1.0` step fails with
ERR_PNPM_UNSUPPORTED_ENGINE before it ever touches the matrix Node.
v6 ships Node 24 and resolves it; also clears the deprecation
warning about Node 20 actions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>