ci: validate pnpm override resolution

[lntutor]

Summary by cubic

Validates pnpm override resolution in CI to prevent lockfile drift. Previously we did not verify overrides; now CI fails if resolved versions don’t satisfy override targets, including parent>dependency selectors, with prerelease-aware matching.

• Details

  • Adds scripts/check-pnpm-overrides.mjs and tests (scripts/check-pnpm-overrides.test.mjs); new scripts: check-pnpm-overrides and test:check-pnpm-overrides.
  • CI workflow adds matrix steps to run pnpm test:check-pnpm-overrides and pnpm check-pnpm-overrides.
  • Skips non-semver override targets; validates across root and workspace lockfiles.

• Dependencies

  • Adds semver and yaml.

^{Written for commit 38a6487. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[lntutor]

Current head bca01879de29ef7807ff5ba76b3a1ba457266032 is mergeable and fully green. The three review findings on this PR are resolved on this exact head, and there are no unresolved review threads remaining. This looks ready for maintainer review when convenient.