pnpm: lockfile is the source of truth

Commit pnpm-lock.yaml for reproducible builds.

git status