Add pnpm@10.33.0 as packageManager, create pnpm-workspace.yaml with minimumReleaseAge (3 days) and onlyBuiltDependencies allowlist (better-sqlite3, esbuild, protobufjs, sharp), update .npmrc as safety-net fallback.
Supply chain protection — npm will not install package versions published less than 7 days ago. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>