Migrated NQL workspace to pnpm (PLA-322) - #201

Why

Complete the NQL portion of PLA-322 by moving the workspace from Yarn Classic to the same fail-closed pnpm supply-chain baseline used by Ghost-owned repositories.

This supersedes #200: it includes that PR's privileged install-script blocking while migrating the underlying install to pnpm.

What changed

• pins pnpm 11.15.1 exactly (including integrity) and replaces yarn.lock with a frozen pnpm-lock.yaml
• enables minimumReleaseAge: 4320, strictDepBuilds: true, and blockExoticSubdeps: true
• uses exact-version build policy:
  • sqlite3@6.0.1: true because the SQLite test matrix requires its native binding
  • nx@23.1.1: false because Lerna's task runner does not require Nx's install-time setup
• migrates workspace scripts, Lerna, development docs, and CI to pnpm
• preserves the Node 22/24 × SQLite/MySQL test matrix
• preserves OIDC trusted publishing, npm provenance, discovery, and publishing of all four workspaces
• keeps --ignore-scripts in the OIDC-enabled publish job, regardless of ordinary CI's reviewed build approvals

Validation

• corepack pnpm install --frozen-lockfile
• corepack pnpm lint
• corepack pnpm build
• corepack pnpm test (SQLite)
• full MySQL 8 integration suite
• privileged install simulation: corepack pnpm install --frozen-lockfile --prefer-offline --ignore-scripts
• npm publish --dry-run --workspaces (all four packages)
• actionlint
• git diff --check