fix(ci): use portable pnpm build-allow config

The allowBuilds map syntax only works in pnpm 11.x, but the
Dockerfile resolves pnpm@latest to a 10.x that doesn't recognize
it, so install fails on unapproved build scripts. Switch to the
onlyBuiltDependencies/ignoredBuiltDependencies arrays and pin
packageManager so CI and local stay in sync.

pnpm-workspace.yaml

@@ -1,7 +1,8 @@
-allowBuilds:
-  '@parcel/watcher': true
-  core-js: false
-  esbuild: true
-  fsevents: true
-  sharp: true
-  vue-demi: true
+onlyBuiltDependencies:
+  - '@parcel/watcher'
+  - esbuild
+  - fsevents
+  - sharp
+  - vue-demi
+ignoredBuiltDependencies:
+  - core-js