The previous attempt set pnpm.onlyBuiltDependencies in package.json. pnpm 10 does not read it from there -- `pnpm config get onlyBuiltDependencies` returns undefined -- so the runner failed exactly as before. It looked fixed locally because the pnpm store had already built both packages, so a reinstall printed no warning whether or not the allowlist was being read. "No warning" was not evidence; `pnpm config get` returning the values is, and it does now. Moves the allowlist to pnpm-workspace.yaml, which is where pnpm 10 takes its settings, and drops the inert package.json field rather than leave two places appearing to configure the same thing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XZG2i4AmfSqE97EJGBVb64