fix(deps): skip building the unused isolated-vm native addon + take n8n-workflow 1.120.22

[ribato22]

The failure

Dependabot #141 (n8n-workflow 1.120.7 → 1.120.22) failed three checks at once — Lint, Typecheck & Build, Public boundary, Dependency audit — with Docker Build and Tests skipped. That pattern is always "the install step died", and the log confirms it:

../src/isolate/holder.h:55:22: error: 'void ivm::IsolateTaskRunner::PostTaskImpl(
std::unique_ptr<v8::Task>, const int&)' marked 'final', but is not virtual
gyp ERR! build error / make failed with exit code: 2
   → node_modules/.pnpm/isolated-vm@6.1.2

Not the SSH-lockfile regression (that guard passed: "OK: no SSH git URLs"). n8n-workflow 1.120.22 introduces a new transitive dependency isolated-vm@6.1.2 — n8n's user-code sandbox — whose native addon doesn't compile against Node 20's V8 headers. main (on 1.120.7) has no isolated-vm at all, so this is a fresh regression, not pre-existing.

The fix

We never execute that sandbox. n8n-workflow is only a devDependency + peerDependency of packages/n8n-nodes-multiwa, used for TypeScript types when building the node; n8n supplies isolated-vm itself at runtime inside the user's own n8n instance.

So instead of pinning n8n-workflow back or ignoring its patch stream (which carries real fixes), add:

"pnpm": {
  "neverBuiltDependencies": ["isolated-vm"]
}

…and take the 1.120.22 bump in the same PR.

Proven locally, not assumed

With the setting in place, pnpm --filter n8n-nodes-multiwa add -D n8n-workflow@1.120.22:

• does pull isolated-vm@6.1.2 into the lockfile (same dep that broke CI)
• completes cleanly with no node-gyp step
• is surgical — the only lockfile change is n8n-workflow's own specifier/version (1.120.7 → 1.120.22); no other dependency moved

Verification

• All 6 workspace packages build ✓ (incl. n8n-nodes-multiwa)
• api / worker / admin typecheck ✓
• api 324/324 · worker 34/34 ✓
• Lockfile still air-gap safe (0 ssh:// refs)

Supersedes #141.