fix(ci): use portable pnpm build-allow config

The allowBuilds map syntax only works in pnpm 11.x, but the
Dockerfile resolves pnpm@latest to a 10.x that doesn't recognize
it, so install fails on unapproved build scripts. Switch to the
onlyBuiltDependencies/ignoredBuiltDependencies arrays and pin
packageManager so CI and local stay in sync.

package.json

@@ -2,6 +2,7 @@
   "name": "remanso",
   "version": "1.0.0",
   "private": true,
+  "packageManager": "pnpm@11.0.9",
   "scripts": {
     "dev": "vite",
     "build": "vite build",
@@ -93,8 +94,5 @@
     "vite": "^8.0.1",
     "vite-plugin-pwa": "^1.2.0",
     "vitest": "^3.2.4"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": ["core-js"]
   }
 }

pnpm-workspace.yaml

@@ -1,7 +1,8 @@
-allowBuilds:
+onlyBuiltDependencies:
-  '@parcel/watcher': true
+  - '@parcel/watcher'
-  core-js: false
+  - esbuild
-  esbuild: true
+  - fsevents
-  fsevents: true
+  - sharp
-  sharp: true
+  - vue-demi
-  vue-demi: true
+ignoredBuiltDependencies:
+  - core-js