Pin pnpm so the Cloudflare build uses the right version

.github/workflows/ci.yml

@@ -17,9 +17,9 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
+      # No version here on purpose: it reads `packageManager` from
+      # package.json, so the pnpm version has one source of truth.
       - uses: pnpm/action-setup@v4
-        with:
-          version: 11.17.0
       - uses: actions/setup-node@v4
         with:
           node-version: 24

package.json

@@ -3,6 +3,7 @@
   "version": "0.0.1",
   "type": "module",
   "private": true,
+  "packageManager": "pnpm@11.17.0",
   "engines": {
     "node": "24.x"
   },

pnpm-workspace.yaml

@@ -1,3 +1,10 @@
+# This repo is not a workspace. The file exists only to hold pnpm settings.
+#
+# `allowBuilds` and `minimumReleaseAgeExclude` are pnpm 11 keys, and pnpm 10
+# rejects a workspace file that has no `packages` field. `package.json` pins
+# `packageManager` to pnpm 11 so every environment agrees, including the
+# Cloudflare build image, which defaults to pnpm 10.
+#
 # Postinstall scripts pnpm is allowed to run. Without these, `pnpm <script>`
 # aborts on its dependency-status check. esbuild backs Vitest, workerd backs the
 # Cloudflare Vite plugin and `wrangler dev`, and sharp backs vite-imagetools.