PLA-322: migrate gscan to pnpm

[9larsons]

Refs PLA-322

Stacked on and blocked by #884. The base is #884's branch so this PR preserves its exact npm 11.19.0 Trusted Publishing pin and lifecycle-script hardening without duplicating those changes against main. After #884 merges, this PR should be retargeted to main.

Summary

• replace Yarn Classic with exact-pinned pnpm 11.19.0 and a frozen pnpm lockfile
• enforce a 72-hour minimum release age, strict dependency builds, and exotic-subdependency blocking
• explicitly deny the optional dtrace-provider@0.8.8 native build; no dependency has a true build approval
• mirror the 72-hour delay in Renovate
• migrate CI, scheduled link checks, Docker builds, developer commands, and release metadata to pnpm
• retain npm 11.19.0 for Trusted Publishing, including OIDC and provenance

Validation

• fresh pnpm install --frozen-lockfile after removing yarn.lock
• pnpm test: 27 files and 423 tests pass, including coverage and post-test lint
• standalone pnpm lint
• pnpm pack --dry-run
• exact npm 11.19.0 publish dry-run (forced only because 6.4.2 already exists)
• package tarball inspection confirms the gscan CLI entry point remains present
• actionlint on all changed workflows
• full Node 24 Docker image build and production module-load smoke test

Existing issues observed

• the scheduled link checker still fails on the same removed Ghost docs URL, redirects, and six rule metadata errors documented on Pin npm and disable lifecycle scripts in workflows #884
• the imported dependency graph preserves an existing peer mismatch: ESLint 10.8.0 is newer than @babel/eslint-parser currently declares support for; the full test and lint suite passes

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c7328929-8b03-40a5-89ee-ea803492bdb9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}