Migrated NQL workspace to pnpm (PLA-322)

[9larsons]

Why

Complete the NQL portion of PLA-322 by moving the workspace from Yarn Classic to the same fail-closed pnpm supply-chain baseline used by Ghost-owned repositories.

This supersedes #200: it includes that PR's privileged install-script blocking while migrating the underlying install to pnpm.

What changed

• pins pnpm 11.15.1 exactly (including integrity) and replaces yarn.lock with a frozen pnpm-lock.yaml
• enables minimumReleaseAge: 4320, strictDepBuilds: true, and blockExoticSubdeps: true
• uses exact-version build policy:
  • sqlite3@6.0.1: true because the SQLite test matrix requires its native binding
  • nx@23.1.1: false because Lerna's task runner does not require Nx's install-time setup
• migrates workspace scripts, Lerna, development docs, and CI to pnpm
• preserves the Node 22/24 × SQLite/MySQL test matrix
• preserves OIDC trusted publishing, npm provenance, discovery, and publishing of all four workspaces
• keeps --ignore-scripts in the OIDC-enabled publish job, regardless of ordinary CI's reviewed build approvals

Validation

• corepack pnpm install --frozen-lockfile
• corepack pnpm lint
• corepack pnpm build
• corepack pnpm test (SQLite)
• full MySQL 8 integration suite
• privileged install simulation: corepack pnpm install --frozen-lockfile --prefer-offline --ignore-scripts
• npm publish --dry-run --workspaces (all four packages)
• actionlint
• git diff --check

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4e16a03c-ff5f-4d3c-813a-9d89f4ed4614

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.18%. Comparing base (30c9986) to head (7da998e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #201   +/-   ##
=======================================
  Coverage   84.18%   84.18%           
=======================================
  Files           9        9           
  Lines        2074     2074           
  Branches      428      428           
=======================================
  Hits         1746     1746           
  Misses        322      322           
  Partials        6        6           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.