chore: sync dependency toolchain into v0.9.10

[numnx]

What changed

• merge the fully validated dependency and Windows installer fixes from dev into release/v0.9.10
• retain the release branch package version at 0.9.10
• include the checksum-pinned NSIS plugin separation that passed native Windows packaging, first-attempt installation, and installed-app launch
• include the pnpm 11 runtime dependency hardening and current compatible dependency set

Validation

• source PR fix: harden Windows installer and dependency toolchain #3156 passed the full backend, dashboard, coverage, audit, build, package-smoke, and orchestration CI lanes
• Playwright: 74 passed
• rapid orchestration: 292 passed, 7 skipped
• native Release Candidate Diagnostics passed package/install/start on Linux, macOS, and windows-latest
• the resulting release tree differs from dev only by the intended package version: 0.9.10 instead of 0.9.9
• git diff --check passed

Risk and rollback

This is an integration-only release sync with no database migration. If release-branch CI exposes a regression, revert this sync merge and keep the existing release candidate while fixes continue through dev.