ci: upgrade pnpm to v11

[denolfe]

Overview

Upgrade the monorepo's package manager from pnpm 10.27.0 to 11.9.0.

pnpm v11 no longer reads the pnpm field from package.json (it is silently ignored), so configuration that lived there moves to pnpm-workspace.yaml.

Key Changes

Bump pnpm to 11.9.0

Updates packageManager, .tool-versions (which drives the CI pnpm version), and the documented version in CLAUDE.md.

Move root pnpm config to pnpm-workspace.yaml

overrides and onlyBuiltDependencies move out of the now-ignored package.json#pnpm field. onlyBuiltDependencies becomes the allowBuilds map that replaces it in v11; overrides carry over with the same values.

Move test-suite pnpm config

The standalone test/ package (installed with --ignore-workspace) keeps its graphql override in a new test/pnpm-workspace.yaml, since its own package.json#pnpm field is also ignored under v11.

Allow pnpm 11 in template engines

templates/blank and templates/website pinned engines.pnpm to ^9 || ^10, which blocked v11 across the whole workspace. Widened to ^9 || ^10 || ^11.

Disable verifyDepsBeforeRun

pnpm v11 changed this setting's default to install, which auto-reinstalls when node_modules looks stale before any pnpm run/pnpm exec. The root prepare script nests pnpm turbo inside the outer install's lifecycle, so that check deadlocks against the in-flight install and CI hangs until the runner sends SIGTERM. Set to false to restore v10 behavior (see pnpm/pnpm#8865).

Design Decisions

pnpm v11's supply-chain defaults (minimumReleaseAge, blockExoticSubdeps) are left on; the install succeeded without needing to relax them. The lockfile is unchanged because the migrated config resolves to identical versions.

verifyDepsBeforeRun: false is preferred over rewriting the nested pnpm calls out of the build scripts. Turbo runs each package's build via pnpm, and those scripts call pnpm build:types/pnpm build:swc in turn, so the nesting can't be removed without touching many packages — out of scope for a version bump.

The $-prefixed override syntax (e.g. $react) is kept as-is. It is deprecated in v11 in favor of catalogs but still works; the catalog migration is left as a follow-up, along with the template .npmrc settings that v11 no longer reads.

References / Links

• pnpm migration guide: https://pnpm.io/migration

[github-actions]

📦 esbuild Bundle Analysis for payload

This analysis was generated by esbuild-bundle-analyzer. 🤖
This PR introduced no changes to the esbuild bundle! 🙌