feat: pnpm 10 and deps hardening

[capJavert]

Basically copy 🍝 from what @rebelchris did with apps. Have to test yet if all works.

[rebelchris]

looks ok on paper

[pulumi]

🍹 The Update (preview) for dailydotdev/api/prod (at 0aa14ed) was successful.

✨ Neo Explanation

Standard deployment promoting commit `0aa14ed` across all 7 deployments and 38 CronJobs, with DB and ClickHouse migration jobs cycling to the new image tag. The underlying change is a pnpm 10 upgrade and dependency pinning with no application logic changes. ✅ Low Risk

This is a routine application deployment rolling out commit 0aa14ed (previously a3c90e32) across all workloads. The code changes are entirely tooling/supply-chain focused: upgrading pnpm from 9.14.4 → 10.33.4, pinning all package.json dependencies to exact versions (removing ^ ranges), adding pnpm-workspace.yaml with minimumReleaseAge and blockExoticSubdeps supply-chain hardening, and removing the Jira PR comment GitHub Action. None of these changes affect application logic, so the new image contains the same runtime behavior with a hardened build toolchain.

The migration Jobs (vpc-native-api-db-migration-* and vpc-native-api-clickhouse-migration-*) are being replaced with new instances tagged to the new commit hash — this is the expected pattern for one-shot migration jobs and does not indicate schema changes beyond what's in the commit.

Resource Changes

    Name                                                       Type                           Operation
-   vpc-native-api-db-migration-a3c90e32                       kubernetes:batch/v1:Job        delete
~   vpc-native-rotate-daily-quests-cron                        kubernetes:batch/v1:CronJob    update
~   vpc-native-daily-digest-cron                               kubernetes:batch/v1:CronJob    update
~   vpc-native-sync-subscription-with-cio-cron                 kubernetes:batch/v1:CronJob    update
~   vpc-native-update-current-streak-cron                      kubernetes:batch/v1:CronJob    update
~   vpc-native-update-achievement-rarity-cron                  kubernetes:batch/v1:CronJob    update
~   vpc-native-channel-highlights-cron                         kubernetes:batch/v1:CronJob    update
~   vpc-native-user-profile-updated-sync-cron                  kubernetes:batch/v1:CronJob    update
~   vpc-native-worker-job-deployment                           kubernetes:apps/v1:Deployment  update
+   vpc-native-api-clickhouse-migration-a293e009               kubernetes:batch/v1:Job        create
~   vpc-native-validate-active-users-cron                      kubernetes:batch/v1:CronJob    update
~   vpc-native-user-profile-analytics-history-clickhouse-cron  kubernetes:batch/v1:CronJob    update
~   vpc-native-hourly-notification-cron                        kubernetes:batch/v1:CronJob    update
~   vpc-native-expire-super-agent-trial-cron                   kubernetes:batch/v1:CronJob    update
~   vpc-native-clean-zombie-users-cron                         kubernetes:batch/v1:CronJob    update
~   vpc-native-check-analytics-report-cron                     kubernetes:batch/v1:CronJob    update
~   vpc-native-clean-stale-user-transactions-cron              kubernetes:batch/v1:CronJob    update
~   vpc-native-bg-deployment                                   kubernetes:apps/v1:Deployment  update
~   vpc-native-update-tags-str-cron                            kubernetes:batch/v1:CronJob    update
~   vpc-native-squad-posts-analytics-refresh-cron              kubernetes:batch/v1:CronJob    update
~   vpc-native-personalized-digest-cron                        kubernetes:batch/v1:CronJob    update
~   vpc-native-clean-zombie-opportunities-cron                 kubernetes:batch/v1:CronJob    update
~   vpc-native-clean-channel-highlights-cron                   kubernetes:batch/v1:CronJob    update
~   vpc-native-calculate-top-readers-cron                      kubernetes:batch/v1:CronJob    update
~   vpc-native-personalized-digest-deployment                  kubernetes:apps/v1:Deployment  update
~   vpc-native-private-deployment                              kubernetes:apps/v1:Deployment  update
~   vpc-native-update-source-public-threshold-cron             kubernetes:batch/v1:CronJob    update
~   vpc-native-generate-search-invites-cron                    kubernetes:batch/v1:CronJob    update
~   vpc-native-clean-zombie-user-companies-cron                kubernetes:batch/v1:CronJob    update
~   vpc-native-generic-referral-reminder-cron                  kubernetes:batch/v1:CronJob    update
~   vpc-native-update-highlighted-views-cron                   kubernetes:batch/v1:CronJob    update
~   vpc-native-update-trending-cron                            kubernetes:batch/v1:CronJob    update
~   vpc-native-update-tag-materialized-views-cron              kubernetes:batch/v1:CronJob    update
~   vpc-native-temporal-deployment                             kubernetes:apps/v1:Deployment  update
-   vpc-native-api-clickhouse-migration-a3c90e32               kubernetes:batch/v1:Job        delete
~   vpc-native-post-analytics-clickhouse-cron                  kubernetes:batch/v1:CronJob    update
~   vpc-native-materialize-yearly-best-post-archives-cron      kubernetes:batch/v1:CronJob    update
~   vpc-native-user-profile-analytics-clickhouse-cron          kubernetes:batch/v1:CronJob    update
~   vpc-native-deployment                                      kubernetes:apps/v1:Deployment  update
+   vpc-native-api-db-migration-a293e009                       kubernetes:batch/v1:Job        create
~   vpc-native-rotate-weekly-quests-cron                       kubernetes:batch/v1:CronJob    update
... and 11 other changes