ci(docker): pin pnpm to 10.33.0 to fix frozen-lockfile build failure

[revtex]

Problem

The Docker image build (docker.yml) has been failing on every main push at the frontend stage:

! Corepack is about to download .../pnpm-11.8.0.tgz
[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.onlyBuiltDependencies", "pnpm.overrides".
[ERR_PNPM_LOCKFILE_CONFIG_MISMATCH] Cannot proceed with the frozen installation. The current "overrides" configuration doesn't match the value found in the lockfile

The Dockerfile runs corepack enable && pnpm install --frozen-lockfile. With no packageManager pin, Corepack provisions the latest pnpm (11.x), which no longer reads the pnpm field (overrides, onlyBuiltDependencies) from package.json. The override set then reads as empty, no longer matches the lockfile, and the frozen install aborts.

This is not specific to any one change — all recent main pushes failed identically. The last green Docker build was a dev commit ("pin pnpm to 10.18.1 via packageManager field") whose pin never reached main.

Fix

Pin pnpm via the packageManager field to 10.33.0 — the exact version that generated the committed pnpm-lock.yaml — so Corepack provisions a pnpm that still honors the pnpm.overrides settings and agrees with the lockfile.

Verification

$ pnpm --version
10.33.0
$ rm -rf node_modules && pnpm install --frozen-lockfile
Done in 12s using pnpm v10.33.0   # exit 0 — reproduces the failing CI step, now passing

A broken Docker publish is user-visible per the repo's release policy, so this adds a ### Fixed bullet under [Unreleased].

🤖 Generated with Claude Code

---

Generated by Claude Code