ci: move pnpm build-script allowlist to pnpm-workspace.yaml

CI's newer pnpm warns "the pnpm field in package.json is no longer read"
and still failed build-web with ERR_PNPM_IGNORED_BUILDS. The settings moved
to pnpm-workspace.yaml in pnpm 10+. Put onlyBuiltDependencies (esbuild,
@swc/core) and ignoredBuiltDependencies (react-vertical-timeline-component)
there and drop the dead package.json field. Verified with a cold
`pnpm install --frozen-lockfile`: postinstalls run, no error, lockfile
unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7zF7Kf4JqDwa6M8Qgge9M

ui/package.json

@@ -33,14 +33,5 @@
     "@vitejs/plugin-react-swc": "^3.7.2",
     "typescript": "~5.7.0",
     "vite": "^6.0.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@swc/core",
-      "esbuild"
-    ],
-    "ignoredBuiltDependencies": [
-      "react-vertical-timeline-component"
-    ]
   }
 }

ui/pnpm-workspace.yaml

@@ -0,0 +1,10 @@
+# pnpm 10+ no longer reads build-script settings from package.json's "pnpm"
+# field — they live here. esbuild and @swc/core need their postinstall to place
+# native binaries for vite; allow those, and explicitly ignore the harmless
+# react-vertical-timeline-component postinstall, so a fresh CI install doesn't
+# fail with ERR_PNPM_IGNORED_BUILDS.
+onlyBuiltDependencies:
+  - '@swc/core'
+  - esbuild
+ignoredBuiltDependencies:
+  - react-vertical-timeline-component