S0149-cli-ci-fuzz: let packageManager decide the pnpm version in Fuzz

[NSchatz]

What

.github/workflows/fuzz.yml passed version: 10 to pnpm/action-setup@v4
while package.json declares "packageManager": "pnpm@10.0.0". The action
treats two version sources as a hard error rather than a redundancy, so setup
failed before installing anything:

Error: Multiple versions of pnpm specified:
  - version 10 in the GitHub Action config with the key "version"
  - version pnpm@10.0.0 in the package.json with the key "packageManager"
Remove one of these versions to avoid version mismatch errors like ERR_PNPM_BAD_PM_VERSION

This drops the version: input so exactly one version resolves, from
packageManager. The direction is forced, not chosen: packageManager: pnpm@10.0.0 is a non-substitutable invariant, so the workflow yields to the
manifest and never the reverse.

Why it mattered

Every scheduled Fuzz run from 2026-08-17 through 2026-08-30 concluded
failure this way, across three head shas, with pnpm install and
pnpm test:fuzz both skipped. The nightly 25000-case property fuzz of the
argv/stdin and MCP boundaries had not actually executed in that window. This is
a standing configuration defect, not a regression from any recent commit.

fuzz.yml is the only workflow here that calls pnpm/action-setup directly
(every other one delegates to the shared reusable pipeline), which is why CI
stayed green the whole time this was red.

Evidence

• Red before: runs/33305359621, step pnpm/action-setup@v4 failure.
• Green after: runs/33307028405, dispatched against this branch.

Scope

One file. package.json, pnpm-lock.yaml, test/fuzz.property.test.ts and
every other workflow are untouched, as are the case count (25000), schedule,
concurrency and permissions.

Out of scope by decision: the Node 20 deprecation warnings for
actions/checkout@v4 and pnpm/action-setup@v4 are warnings, do not fail the
job, and a major bump is separate work.

Spec: work/specs/S0149-cli-ci-fuzz/spec.md in the meta repo.