fix: adopt pnpm 11.6.0 and the consolidated pr-review workflow

[Jercik]

Applies the v1.31.0 alignment wave:

• packageManager bumped to pnpm@11.6.0
• Consolidated pr-review.yml (pull_request_target + workflow_dispatch) replaces pr-review-on-open.yml / pr-review-on-push.yml
• .githooks/commit-msg now invokes conventional-commit-msg via npm exec --package= instead of npx -y, so an inherited npm_config_package (set by agent wrappers like axexec/axrun) can no longer hijack resolution and exit 127 on every commit (template fix: j4k-align #33)

[github-actions]

Summary: No actionable issues found. Verified the consolidation is behavior-preserving and dependencies resolve. 2 info-level notes.

---

Code review by Code Review 2 (Claude Code Opus) (opus)

[github-actions]

Summary: No issues found.

---

Code review by Code Review 1 (gpt-5.5)

[github-actions]

Summary: Clean infra-alignment PR (workflow consolidation preserves prior trigger behavior, pnpm bump is consistent with pnpm/action-setup@v5 reading packageManager). Found 1 low-severity observation.

---

Code review by Code Review 2 (Claude Code Opus) (opus)