chore: pnpm — the fleet has one package manager

[catomean]

Converts reparaturbonus-zh from npm to pnpm per the fleet-wide Wave 7 Phase B migration (batch-1-proven recipe):

• packageManager: pnpm@11.25.0 pin
• pnpm-lock.yaml imported from package-lock.json (npm lockfile removed)
• pnpm-workspace.yaml with allowBuilds: esbuild + unrs-resolver
• The npm-only top-level overrides field (deepmerge-ts security pin from fix(security): override deepmerge-ts to close #77 (high severity) #114 — pnpm ignores that field) moved to pnpm-workspace.yaml overrides, recorded in the lockfile; the dep has left the tree but the pin stays armed
• CI: pnpm/action-setup@v6 + cache: pnpm + pnpm install --frozen-lockfile + pnpm run verify / pnpm run build
• Internal script chains (verify, setup), dev.sh, and docs converted

Deploy is untouched: the shared selfhost-deploy workflow auto-detects pnpm.

Verified locally: pnpm run verify green (prettier, eslint, tsc, vitest 35/35) + hermetic pnpm run build green; clean-room rm -rf node_modules && pnpm install --frozen-lockfile + tests green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WqKqMnHQHSmkGFfc5t7Rxn