The readme has code examples that pass --frozen-lockfile, but this seems unnecessary.

According to the pnpm install docs:

In a CI environment, installation fails if a lockfile is present but needs an update.

So in CI, --frozen-lockfile is the default behavior, unless I'm missing something.