ci(web): declare the build allowlist in both places, and report pnpm's view

Third build-web failure with the same ERR_PNPM_IGNORED_BUILDS. The
setting was first in package.json (pnpm 10 here does not read it) and
then in pnpm-workspace.yaml (verified read here, still ignored on the
runner), so the runner's pnpm evidently resolves it differently and I
have been guessing at which.

Declares it in both locations -- four duplicated lines against a failure
that only manifests on CI -- and adds a step printing pnpm --version and
the resolved value, so if this still fails the log says why instead of
costing another round trip.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XZG2i4AmfSqE97EJGBVb64

.gitea/workflows/ci.yml

@@ -33,6 +33,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # The runner's pnpm is not necessarily the workstation's, and this
+      # setting moved location between 10.x releases. Print what it actually
+      # resolves to, so a failure here is diagnosable from the log rather than
+      # by pushing another guess.
+      - name: pnpm environment
+        working-directory: web
+        run: |
+          pnpm --version
+          pnpm config get --json onlyBuiltDependencies || true
+          pnpm config list || true
+
       - name: install
         working-directory: web
         run: pnpm install --frozen-lockfile

.gitea/workflows/deploy.yml

@@ -61,6 +61,17 @@ jobs:
 
       # The gate for the frontend, matching the Rust one: a type error or a
       # lint failure must not reach a host either.
+      # The runner's pnpm is not necessarily the workstation's, and this
+      # setting moved location between 10.x releases. Print what it actually
+      # resolves to, so a failure here is diagnosable from the log rather than
+      # by pushing another guess.
+      - name: pnpm environment
+        working-directory: web
+        run: |
+          pnpm --version
+          pnpm config get --json onlyBuiltDependencies || true
+          pnpm config list || true
+
       - name: install
         working-directory: web
         run: pnpm install --frozen-lockfile

web/package.json

@@ -32,5 +32,11 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.46.2",
     "vite": "^7.2.2"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@swc/core",
+      "esbuild"
+    ]
   }
 }

web/pnpm-workspace.yaml

@@ -1,9 +1,12 @@
-# pnpm 10 reads settings from here, not from package.json's `pnpm` field.
+# The allowlist of dependencies permitted to run install scripts. Both fetch a
+# platform-native binary; every other package in the tree is denied, which is
+# the point -- an install script is arbitrary code from a transitive dependency.
 #
-# An explicit allowlist of dependencies permitted to run install scripts. Both
-# fetch a platform-native binary at install time and do not work without it;
-# every other package in the tree is denied, which is the point — an install
-# script is arbitrary code from a transitive dependency.
+# Declared here *and* in package.json's `pnpm` field on purpose: pnpm moved
+# this setting between 10.x releases, and the workstation and the CI runner do
+# not carry the same version. Whichever one is authoritative, it finds the same
+# list, and the duplication is four lines against a failure that only shows up
+# on the runner.
 onlyBuiltDependencies:
   - '@swc/core'
   - esbuild