fix(ci): use pnpm/action-setup + pnpm install --frozen-lockfile across all CI workflows

[Aycode01]

Summary

Closes #1410

This repository is unambiguously pinned to pnpm as its package manager:

• package.json declares "packageManager": "pnpm@9.0.0" and "engines": { "pnpm": ">=9.0.0" }
• pnpm-lock.yaml is committed
• .npmrc / pnpm-workspace conventions are in place

However, every CI workflow that installs JS dependencies was running npm ci against a committed package-lock.json with actions/setup-node cache: 'npm'. Because package-lock.json is never regenerated by pnpm operations (pnpm add/pnpm update never touch it), CI could silently install a different dependency tree than pnpm install produces locally — defeating the point of pinning packageManager.

Changes

1. All six workflows now install dependencies with pnpm

Each workflow now:

1. Sets up pnpm via pnpm/action-setup@v4 (pinned to 9.0.0, matching package.json)
2. Configures actions/setup-node with cache: 'pnpm' (hashes pnpm-lock.yaml)
3. Installs dependencies with pnpm install --frozen-lockfile — the pnpm equivalent of npm ci, installing exactly the tree in pnpm-lock.yaml

Workflows updated (7 install sites across 6 files):

Workflow	Job(s)
.github/workflows/coverage.yml	coverage (Vitest coverage) + openapi (OpenAPI validation)
.github/workflows/deadcode.yml	knip
.github/workflows/size-limit.yml	size-limit
.github/workflows/lighthouse.yml	lighthouse
.github/workflows/typecheck.yml	typecheck (tsc --noEmit)
.github/workflows/circular-deps.yml	circular (madge)

2. package-lock.json removed from the repository

• package-lock.json was removed from git tracking (it was 14,928 lines of stale drift — a different tree than pnpm-lock.yaml).
• Added package-lock.json to .gitignore to prevent it from being accidentally re-committed in the future.
• Note: the Lighthouse CI global CLI install (npm install -g @lhci/cli@0.14.x) is intentionally kept as-is — it is a global tool install that never touches the repo's lockfiles, so it poses no drift risk. This is consistent with the acceptance criteria (all project dependency installs use pnpm).

Why this matters

Without this change, CI uses npm ci + the stale package-lock.json while every developer workflow uses pnpm + pnpm-lock.yaml. Any dependency added/updated via pnpm would:

• Not update package-lock.json (drift starts immediately)
• Cause CI to install a different, unverified dependency tree than local development

This change makes CI installs byte-for-byte reproducible with what pnpm install produces locally, and gates installs on the lockfile being in sync (--frozen-lockfile fails CI if package.json and pnpm-lock.yaml diverge).

Validation performed locally

• ✅ pnpm install --frozen-lockfile succeeds — "Lockfile is up to date, resolution step is skipped" → confirms pnpm-lock.yaml is in sync with package.json (the core acceptance criterion)
• ✅ All 6 modified workflow YAML files parse as valid YAML
• ✅ grep -rn "npm ci" .github/workflows/ → zero remaining occurrences
• ✅ pnpm run circular (madge) passes — no circular dependencies
• ✅ bash validate-openapi.sh — API description is valid (pre-existing warnings only, unchanged)
• ✅ All cache: 'npm' references replaced with cache: 'pnpm' in the six workflows

Pre-existing failures (NOT introduced by this PR)

The following failures exist on master today, independently of this PR (verified by stashing this PR's changes and re-running):

• pnpm run typecheck — pre-existing errors in CreateCommitmentStepConfigure.tsx and MarketplaceHeader.tsx (the typecheck workflow is intentionally non-blocking via continue-on-error: true, per the documented type-error backlog in the workflow comment)
• pnpm run lint — pre-existing unused-variable / no-explicit-any / a11y errors in test files
• pnpm test — pre-existing failures in API route tests (e.g., commitments/[id]/fund/route.test.ts), ~35 failing tests across 20 files
• pnpm run build — pre-existing missing modules (@/lib/clientEnv, @/components/dashboard/CommitmentHealthMetrics, etc.) referenced from commitments/[id]/page.tsx
• pnpm run deadcode (knip) — report-only by design (continue-on-error: true), existing backlog

None of these are touched by or related to this PR's scope (CI infrastructure only). They should be tracked/fixed in separate issues/PRs.

Files changed

• .github/workflows/coverage.yml
• .github/workflows/deadcode.yml
• .github/workflows/size-limit.yml
• .github/workflows/lighthouse.yml
• .github/workflows/typecheck.yml
• .github/workflows/circular-deps.yml
• .gitignore
• package-lock.json (deleted)

[vercel]

@Aycode01 is attempting to deploy a commit to the 1nonly's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Aycode01 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits