chore: migrate to pnpm 11 with supply-chain defaults

[llbbl]

Closes #27

Summary

Migrates @llbbl/polydoc-core from pnpm 10.34.5 to pnpm 11.18.0 and adopts pnpm 11's supply-chain hardening defaults.

pnpm-lock.yaml is unchanged — lockfileVersion: '9.0' is identical between pnpm 10 and 11, so nothing was regenerated.

Breaking: Node 20 dropped

pnpm 11 is pure ESM and requires Node >=22. The 20.x matrix leg would fail at pnpm install, so it is removed and engines.node is raised ">=20" → ">=22" to match what CI actually tests.

Node 20 reached end-of-life in April 2026 and no longer receives security updates. Leaving engines.node: ">=20" while CI no longer exercised Node 20 would have advertised unverified support.

Consumers still on Node 20 (polydoc, TeamWiki) will see an engines warning on install. The package is pre-1.0 (0.1.1), so this is a reasonable point to make the change.

release.yml needed no change — it already pins Node 22.x.

Changes

package.json

Field	From	To
packageManager	pnpm@10.34.5	pnpm@11.18.0
engines.node	>=20	>=22

.github/workflows/ci.yml — 20.x removed from the checks matrix (now 22.x, 24.x), with a comment recording why. Both workflows use pnpm/action-setup@v6 with no version: pin, so they pick up 11.18.0 from packageManager automatically.

pnpm-workspace.yaml — new. pnpm 11 makes this the home for all pnpm settings (.npmrc is auth/registry only now), so it is created even though this is not a workspace. Defaults are written out explicitly so the security posture is visible in review:

minimumReleaseAge: 1440       # block packages younger than 24h
blockExoticSubdeps: true      # no git/tarball transitive deps
strictDepBuilds: true         # fail install on unapproved postinstalls
verifyDepsBeforeRun: install  # re-check lockfile before `pnpm run`
allowBuilds: {}

Build-script allowlist: empty, and enforced

allowBuilds is empty because no dependency in this tree requests a build script — pnpm install completed with no ERR_PNPM_IGNORED_BUILDS. With strictDepBuilds: true, the install would fail if one ever appeared, so this staying empty is an enforced property rather than an oversight.

Verification

Check	Result
pnpm install	clean, no ignored builds
pnpm install --frozen-lockfile	reproducible, no lockfile drift
pnpm format:check	clean (17 files)
pnpm lint	clean (17 files)
pnpm typecheck	clean
pnpm test	235 passed, 2 skipped
pnpm test with POLYDOC_REQUIRE_PANDOC=1	236 passed, 1 skipped (Pandoc 3.10 locally)
pnpm check:package	attw 🟢 across node10 / node16 / bundler for every entry point; publint --strict All good!
pnpm audit signatures	277/277 packages have verified registry signatures
Supply-chain policy check	lockfile passes, 277 entries validated

check:package was the gate that mattered most here — packaging breakage is invisible to lint, typecheck, and tests, and only surfaces for a consumer after publish. All entry points (., ./google, ./sharepoint, ./package.json) resolve cleanly.

Follow-up (not in this change)

@types/node is pinned at ^20.19.43, now inconsistent with engines.node: ">=22". Bumping it may surface new type errors, so it is left for a separate PR.