feat: Enforce pnpm usage

Adds a GitHub Actions workflow and package.json configuration to ensure
all contributors use pnpm. This prevents the accidental inclusion of npm
lockfiles and enforces consistent package management.

Author: ibolmo

.github/workflows/enforce-pnpm.yml

@@ -0,0 +1,17 @@
+name: Enforce pnpm
+
+on:
+  pull_request:
+  push:
+
+jobs:
+  reject-npm-lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Reject npm lockfiles
+        run: |
+          if git ls-files | grep -E '(^|/)package-lock\.json$'; then
+            echo "Remove package-lock.json and use pnpm."
+            exit 1
+          fi

.npmrc

@@ -1 +1,2 @@
 min-release-age=3 # days
+engine-strict=true

package.json

@@ -1,10 +1,23 @@
 {
   "scripts": {
+    "preinstall": "node -e \"const userAgent = process.env.npm_config_user_agent || ''; if (process.env.INIT_CWD === process.cwd() && !userAgent.includes('pnpm/')) { console.error('Use pnpm in this repo.'); process.exit(1); }\"",
     "build": "turbo run build",
     "watch": "turbo run watch",
     "dev": "turbo run dev",
     "start": "turbo run start"
   },
+  "engines": {
+    "pnpm": ">=10.27.0",
+    "npm": "please-use-pnpm",
+    "yarn": "please-use-pnpm"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": ">=10.27.0",
+      "onFail": "error"
+    }
+  },
   "devDependencies": {
     "tslab": "^1.0.21"
   },