chore(ci): commit pnpm-lock.yaml and install frozen

[saby1101]

Stacked on #10 (fix/filestore-contract), since that is still unmerged. Retarget to main once #10 lands.

The gap

.gitignore excluded package-lock.json, pnpm-lock.yaml and yarn.lock, and all three CI jobs ran npm install — never npm ci. So nothing pinned what this package shipped:

• every test run, build and publish resolved dependencies fresh from the registry
• the published artifact was never built from a tree anyone had reviewed
• a broken or hostile transitive release would land silently, with no lockfile diff to catch it in review

This package is loaded by every wms service in production, which is what makes it worth fixing first.

Change

pnpm-lock.yaml is now committed (4,972 lines, 344 resolutions) and CI installs --frozen-lockfile, so a dependency change has to show up as a reviewable diff.

Standardised on pnpm rather than npm: it matches wms and the rest of the org, the repo already carried pnpm-workspace.yaml, and .claude/skills/release/SKILL.md already documented pnpm commands. The version is pinned via packageManager in package.json, which pnpm/action-setup reads — so CI and local use the same pnpm.

Also folded in, since both were touched anyway:

• The Node version was hardcoded in three places across two workflows and could drift independently; it now comes from one env: NODE_VERSION per workflow.
• actions/setup-node gets cache: pnpm, which the lockfile makes possible.
• CONTRIBUTING.md said "Add tag for a minor/major release by npm version minor" — wrong on two counts. It contradicted .claude/skills/release/SKILL.md ("Do NOT create git tags") and misidentified the publish trigger, which is release: created, not a push. That contradiction is what sent PR chore(deps): fastify-plugin 6, lazy-load cloud SDKs, 100% coverage #6 wrong originally, so leaving it in place would keep costing. Rewritten to describe setup, the review rules on main, and how releases actually work.
• .gitignore also carried service-template cruft (config/*, !config/dev.yml, data, bin, env) for directories a plugin library does not have.

Deliberately not included

--provenance on publish. It is the natural companion to a lockfile, but GitHub Packages does not accept provenance attestations — adding it would break the publish job, which is the one workflow that cannot be safely tested before it runs for real. Left alone, with a comment recording why.

Verification

rm -rf node_modules && pnpm install --frozen-lockfile succeeds from the committed lockfile, build is clean, and the suite is unchanged at 127 tests, 100% coverage on statements, branches, functions and lines.

Note the workflows take no input from github.event or github.head_ref, so there is no injection surface in the changed files.