fix: make v0.1.42 release installs reproducible

[Obed0101]

Summary

• add a pinned pnpm 11 lockfile and workspace configuration for the MendCode runtime
• preserve the existing Bun runtime/build while using pnpm for dependency installation
• scan and install the release dependency graph from the same frozen lockfile
• retain the seven-day release-age policy and the existing dependency overrides

Validation

• pnpm --pm-on-fail=ignore install --frozen-lockfile --ignore-scripts passed in an isolated worktree
• Bun Darwin arm64 release build smoke test passed
• supply-chain preflight passed
• git diff --check passed

This is required because the previous hand-edited Bun lockfile failed Bun frozen-lockfile validation during the release dry-run.