Migrate from npm + prettier to pnpm + oxfmt

[esimkowitz]

Summary

• Swap the JS toolchain to pnpm 10.33.2 (pinned via packageManager so Corepack auto-installs the right version locally and in CI) and replace prettier with oxfmt 0.47 for non-Rust files. dx fmt still owns all *.rs files.
• Update both GitHub Actions workflows (ci.yml, build-site.yml) to install via pnpm install --frozen-lockfile with pnpm/action-setup@v4 and cache: "pnpm".
• Rename .prettierrc → .oxfmtrc.json and .prettierignore → .oxfmtignore (oxfmt accepts the same option names). Husky and VSCode configs updated; oxc.oxc-vscode replaces esbenp.prettier-vscode.

Notable Decisions

• pnpm.onlyBuiltDependencies: ["@parcel/watcher"] is committed to package.json. pnpm fail-closes on dependency install scripts by default; @parcel/watcher (pulled in by @tailwindcss/cli for --watch mode) needs that script approved. This makes the trust decision reproducible and reviewable instead of living in each developer's pnpm-store state.
• One-time format sweep from oxfmt: Cargo.toml long inline feature arrays became multiline, and public/js/darkmode.js + public/js/ghpages_redirect.js were cleaned up (mixed quotes, missing semicolons, missing trailing newlines). Prettier should have caught the JS files via its glob but apparently never had — oxfmt fixed them.
• Dependabot's package-ecosystem: "npm" block is unchanged — Dependabot's "npm" ecosystem natively supports pnpm-lock.yaml, so renaming would break it.

Test plan

• CI format job passes (oxfmt --check + dx fmt --check)
• CI build job passes (pnpm build:web produces the wasm bundle)
• CI clippy job passes (untouched by this PR)
• build-site workflow passes on merge to main
• Local: pnpm install is clean (no "Ignored build scripts" warning)
• Local: pnpm format:check and pnpm format both work
• Local: pnpm serve:web starts Tailwind watcher + dx serve
• Local: husky pre-commit fires pnpm exec lint-staged on a staged JS/CSS change

🤖 Generated with Claude Code

---

Note

Medium Risk
Mostly build/tooling changes, but it alters the package manager, lockfile, formatting pipeline, and CI workflows, which can break installs or builds if pnpm/corepack assumptions differ across environments.

Overview
Switches the JS toolchain from npm to pnpm, updating GitHub Actions workflows to set up pnpm, cache it, install via pnpm install --frozen-lockfile, and run build/format scripts through pnpm.

Replaces Prettier with oxfmt for non-Rust formatting (including lint-staged and VSCode defaults), adds pnpm-lock.yaml/pins pnpm@10.33.2, and removes package-lock.json.

Includes a repo-wide formatting sweep (e.g., Cargo.toml formatting and small JS cleanup in public/js/*).

^{Reviewed by Cursor Bugbot for commit d85b3ff. Bugbot is set up for automated code reviews on this repo. Configure here.}