[rush] Add pnpm 11 support: allowBuilds in pnpm-workspace.yaml

[Copilot]

pnpm 11 removed support for the pnpm field in package.json (including onlyBuiltDependencies/neverBuiltDependencies) and replaced it with allowBuilds: Record<string, boolean> in pnpm-workspace.yaml. Rush was still writing the old fields, causing [ERR_PNPM_IGNORED_BUILDS] on every install, and rush-pnpm approve-builds would run but never update any config files.

Changes

New globalAllowBuilds config field (pnpm 11+)

• Added globalAllowBuilds?: Record<string, boolean> to pnpm-config.json schema and PnpmOptionsConfiguration
• Written to allowBuilds in the generated pnpm-workspace.yaml during installation
• true = package allowed to run build scripts; false = explicitly denied

// common/config/rush/pnpm-config.json
{
  "globalAllowBuilds": {
    "esbuild": true,
    "@parcel/watcher": true,
    "fsevents": false
  }
}

Backward compatibility

When using pnpm 11 with the old globalOnlyBuiltDependencies/globalNeverBuiltDependencies fields, Rush automatically converts them to allowBuilds format (entries become true/false respectively) and emits a deprecation warning directing users to migrate to globalAllowBuilds.

InstallHelpers.ts

For pnpm ≥ 11.0.0, skips writing neverBuiltDependencies/onlyBuiltDependencies to common/temp/package.json (pnpm 11 ignores the pnpm field entirely).

approve-builds command

For pnpm ≥ 11.0.0, rush-pnpm approve-builds now correctly reads the updated allowBuilds map from pnpm-workspace.yaml (written by pnpm approve-builds) and persists it back to pnpm-config.json as globalAllowBuilds, then re-runs rush update. Previously this was reading from package.json which pnpm 11 no longer updates.