ci: add frozen pnpm install check

[vorflux]

Adds an install-only dependency-integrity check for PNPM and removes unnecessary dependency lifecycle-script trust. The workflow verifies that the committed lockfile installs reproducibly without exposing credentials or running package install hooks.

Changes

• Run pnpm install --frozen-lockfile for pull requests into and pushes to develop, using pinned Node.js 24.18.0 and PNPM 10.34.5 with lockfile-keyed PNPM store caching.
• Restrict the workflow to read-only repository access, disable persisted checkout credentials, cancel stale runs, and pin every action to an immutable commit.
• Set an explicit empty dependency build-script allowlist and deny the five lifecycle-script packages found in the current graph: @firebase/util, esbuild, protobufjs, sharp, and unrs-resolver.

Testing

• Passed: clean isolated install with exact Node.js 24.18.0 and PNPM 10.34.5:
  • pnpm install --frozen-lockfile --reporter ndjson
  • Parsed all 3,365 NDJSON records; found zero pnpm:lifecycle events.
• Passed: workflow syntax with actionlint 1.7.12:
  • actionlint .github/workflows/ci.yml
• Passed: real consumer probes through the prepared harness:
  • <isolated-workspace>
  • Verified a tsx execution and esbuild transform, a Next-anchored sharp PNG operation, and an anchored unrs-resolver ResolverFactory operation.
• Passed: lockfile immutability:
  • <isolated-run-root>
  • Before, after, and origin/develop SHA-256: a51e86240e834ce51afc04ecb0367cbc526e1fd23c6ef52be4ca1b1bc2e759aa.
• Passed: git diff --check and final two-file scope review.
• Not clean, informational: pnpm audit reported 69 pre-existing findings: 6 low, 28 moderate, 32 high, and 3 critical. These require urgent dependency-remediation follow-up and are not represented as passing.
• Not run: no test script exists; next lint is invalid on Next.js 16; next build requires FIRESTORE_CONFIG during page-data collection. None is represented as passing.

Test evidence:

---

Attached Images

[run_consumer_probes.sh]

[verify_lockfile.sh]

[REPORT.md]

View in Vorflux Session

---

Session Details

• Session: View Session
• Requested by: Unknown
• Address comments on this PR. Add (aside) to your comment to have me ignore it.