Migrate theme-tools to pnpm

[graygilmore]

Summary

Migrates theme-tools from Yarn to pnpm so dev up can run again with minimum dependency age enforcement enabled.

This updates the dev environment, package manager metadata, workspace config, lockfile, package scripts, CI/release workflows, VS Code tasks, and the public setup docs.

Why

dev up now blocks Yarn projects because the supply-chain protection we use for JavaScript dependencies does not support Yarn. pnpm is supported, so this moves the repo onto pnpm instead of opting out of that protection.

A few non-obvious changes

Most of this is mechanical yarn -> pnpm, but a few things are worth calling out:

• pnpm does not let packages silently borrow dependencies from another package's node_modules. A few dependencies are now declared where they were already imported directly.
• pnpm.onlyBuiltDependencies is pnpm's allowlist for dependency install scripts. This keeps the list small and explicit instead of making every developer or CI run pnpm approve-builds interactively.
• GitHub Actions now installs pnpm with pnpm/action-setup before actions/setup-node. setup-node runs pnpm while restoring the pnpm cache, so corepack enable in a later step was too late and caused CI to fail before install started.
• Workspace builds run with --workspace-concurrency=1 because a few packages expect generated files from earlier packages. This keeps the old build order behavior rather than racing those generated files.
• The VS Code webpack config and prettier-plugin test setup now resolve Prettier through Node resolution instead of assuming hoisted node_modules/prettier2 or node_modules/prettier3 paths. pnpm stores package aliases differently, so the old paths were too specific to Yarn.
• The TS config now targets es2022 because the codebase already uses Array.prototype.at. The language server common package also includes browser globals because it uses things like URL, timers, and console.
• The syntaxes submodule install uses --ignore-workspace so pnpm treats it as its own package instead of trying to fold it into the root workspace.

I intentionally left scripts/dev-admin-build.sh and scripts/dev-admin-init.sh on Yarn. Those need a separate pass because the linking behavior is a little more involved than a straight command swap.

Testing

• GitHub Actions CI is green on this branch
• dev up
• pnpm install --frozen-lockfile --config.confirmModulesPurge=false
• pnpm build
• pnpm test --run
• Parsed the updated workflow YAML files with the repo's yaml dependency
• git diff --check

I did not run branch-scoped dev test -i / dev style -i / dev check -i because this repo does not define those project commands in dev.yml; the pnpm scripts above are the relevant checks here.

🎩 Tophatting

1. Pull this branch.
2. Run dev up from the repo root.
3. Confirm it no longer fails with the deprecated package manager warning.
4. Run pnpm install --frozen-lockfile.
5. Run pnpm build and pnpm test --run.