fix(web): put the build-script allowlist where pnpm 10 actually reads it

The previous attempt set pnpm.onlyBuiltDependencies in package.json.
pnpm 10 does not read it from there -- `pnpm config get
onlyBuiltDependencies` returns undefined -- so the runner failed exactly
as before.

It looked fixed locally because the pnpm store had already built both
packages, so a reinstall printed no warning whether or not the allowlist
was being read. "No warning" was not evidence; `pnpm config get`
returning the values is, and it does now.

Moves the allowlist to pnpm-workspace.yaml, which is where pnpm 10 takes
its settings, and drops the inert package.json field rather than leave
two places appearing to configure the same thing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XZG2i4AmfSqE97EJGBVb64

web/package.json

@@ -32,11 +32,5 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.46.2",
     "vite": "^7.2.2"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@swc/core",
-      "esbuild"
-    ]
   }
 }

web/pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+# pnpm 10 reads settings from here, not from package.json's `pnpm` field.
+#
+# An explicit allowlist of dependencies permitted to run install scripts. Both
+# fetch a platform-native binary at install time and do not work without it;
+# every other package in the tree is denied, which is the point — an install
+# script is arbitrary code from a transitive dependency.
+onlyBuiltDependencies:
+  - '@swc/core'
+  - esbuild