Frontend: replace Yarn with pnpm

[gusthoff]

Rationale

Yarn 4 is configured in legacy nodeLinker: node-modules mode (.yarnrc.yml),
which means it gets none of the speed benefits of Yarn Berry's Plug'n'Play
resolver. Every cold install reads, links, and validates a 275 MB node_modules
tree built from a 10,619-line lock file. On CI, where no cache survives between
runs, this cost is paid in full on every job.

pnpm addresses this directly:

• Uses a content-addressable global store and hard-links packages into
  node_modules, so disk space is shared across projects on the same machine.
• Cold install is significantly faster than Yarn node-modules mode.
• Warm install is near-instant when the lock file is unchanged — only
  missing hard-links are created.
• Enforces a strict node_modules layout (only declared dependencies are
  accessible), eliminating a class of hidden-dependency bugs.

Changes

• Replace yarn.lock with pnpm-lock.yaml, generated via pnpm import to
  preserve existing resolved versions. Declare pnpm@11.3.0 as the
  packageManager.
• Remove yarn.lock, .yarnrc.yml, and .yarn/.
• Replace all yarn run invocations with pnpm run in Makefile,
  package.json scripts, and CI workflows; switch CI node caching from yarn
  to pnpm.
• Update Vagrantfile VM provisioners to install via pnpm instead of Yarn.
• Add pnpm-workspace.yaml to approve build scripts for @parcel/watcher
  (native bindings) and es5-ext (pnpm 11 moved this setting out of
  package.json).
• Update README.md, frontend/web_tests/README.md, and
  frontend/.gitignore.

Validation

Tested on the web VM (Node 24.14.1, pnpm 11.3.0):

• pnpm install --frozen-lockfile — exits cleanly, both approved build
  scripts run
• make webpack-production — exit 0; 3 asset-size warnings (pre-existing)

Notes

• pnpm 11 no longer reads the pnpm key in package.json; project-level
  settings now live in pnpm-workspace.yaml. This is why allowBuilds is
  configured there rather than in package.json.
• The .yarn entry in the root .gitignore is intentionally kept as a
  safeguard against accidentally re-initialising Yarn.
• pnpm-lock.yaml was generated with pnpm import (best-effort conversion
  from yarn.lock) rather than a fresh pnpm install, preserving the resolved
  versions from the existing lock file.

---

Co-authored-by: Claude Sonnet 4.6 noreply@anthropic.com