pnpm 10 refuses to silently run a dependency's build script. Locally that is a warning; on the runner it is ERR_PNPM_IGNORED_BUILDS and the job fails, so build-web broke on run 13 while everything passed here. @swc/core and esbuild both fetch a platform-native binary at install time and do not work without it, so they are allowlisted explicitly via pnpm.onlyBuiltDependencies. Everything else in the tree stays denied, which is the point of the feature -- an install script is arbitrary code from a transitive dependency. Also sets strict-dep-builds in web/.npmrc so a skipped build script is an error here too. Same reasoning as the release-age policy added earlier: a local install that passes where the runner fails is a difference only discoverable by pushing, and that is a slow way to find out. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XZG2i4AmfSqE97EJGBVb64