Fix CI frontend build: pin pnpm, approve dependency build scripts

The Docker build's unpinned corepack resolved a newer pnpm that hard-
errors on unreviewed dependency build scripts (ERR_PNPM_IGNORED_BUILDS),
failing deploy task 80. Pin packageManager to the locally-verified
pnpm 10.33.1 and review the build scripts: @swc/core and esbuild are
approved (vite needs their native binaries), @scarf/scarf is ignored.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/pnpm-workspace.yaml

@@ -1,3 +1,11 @@
+# Build-script review (pnpm 10 refuses to run unreviewed dependency scripts).
+# vite needs the native binaries these two postinstalls provide:
+onlyBuiltDependencies:
+  - "@swc/core"
+  - esbuild
+
+# Deliberately not built:
 ignoredBuiltDependencies:
+  - "@scarf/scarf" # telemetry only
   - sharp
   - unrs-resolver