Fix CI frontend build: pin pnpm, approve dependency build scripts

The Docker build's unpinned corepack resolved a newer pnpm that hard-
errors on unreviewed dependency build scripts (ERR_PNPM_IGNORED_BUILDS),
failing deploy task 80. Pin packageManager to the locally-verified
pnpm 10.33.1 and review the build scripts: @swc/core and esbuild are
approved (vite needs their native binaries), @scarf/scarf is ignored.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/package.json

@@ -3,6 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
+  "packageManager": "pnpm@10.33.1",
   "scripts": {
     "dev": "concurrently -k -n vite,ck -c cyan,magenta \"vite --host 0.0.0.0 --port 3000\" \"tsx watch server.ts\"",
     "build": "vite build",

frontend/pnpm-workspace.yaml

@@ -1,3 +1,11 @@
+# Build-script review (pnpm 10 refuses to run unreviewed dependency scripts).
+# vite needs the native binaries these two postinstalls provide:
+onlyBuiltDependencies:
+  - "@swc/core"
+  - esbuild
+
+# Deliberately not built:
 ignoredBuiltDependencies:
+  - "@scarf/scarf" # telemetry only
   - sharp
   - unrs-resolver