ci: bump pnpm/action-setup from 4 to 6

[dependabot]

Summary

Automated dependency/workflow update for jscraik/diagram-cli PR #74. Scope is limited to the version bump in this branch.

Checklist

• Change scope reviewed and limited to dependency/workflow updates.
• No runtime feature behavior changes intended by this PR.
• Follow-up validation is tracked via CI checks on this PR.

Testing

• CI is the validation source for this automation-driven update.
• No additional local test run was performed in this pass.

Review artifacts

• PR: ci: bump pnpm/action-setup from 4 to 6 #74
• Diff: automation-generated dependency/workflow bump only.

Notes

This body was updated to satisfy repository PR template requirements so checks can evaluate the actual code/workflow changes.

[dependabot]

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

📊 Architecture Impact Analysis

Metric	Value
Changed Components	0
Blast Radius	0
Risk Level	⚪ none (score: 0)

📋 Details

{"schemaVersion":"1.0","generatedAt":"2026-04-25T05:33:04.926Z","base":"be93aa70540bd53b67491ac4eb3e7bd4a313fc1f","head":"b4f87008bbc7964a38749eaa09cb9a134481bf25","changedFiles":[".github/workflows/harness-update-check.yml"],"renamedFiles":[],"deletedFiles":[],"addedFiles":[],"unmodeledChanges":[".github/workflows/harness-update-check.yml"],"changedComponents":[],"dependencyEdgeDelta":{"added":[],"removed":[],"count":0},"blastRadius":{"depth":2,"truncated":false,"omittedCount":0,"impactedComponents":[]},"risk":{"score":0,"level":"none","flags":[],"factors":{"authTouch":false,"securityBoundaryTouch":false,"databasePathTouch":false,"blastRadiusSize":0,"blastRadiusDepth":0,"edgeDeltaCount":0},"override":{"applied":false,"reason":null}},"_meta":{"status":"complete","durationMs":847,"baseComponents":104,"headComponents":104},"agentSummary":{"changedComponents":0,"riskReasons":[],"suggestedReviewerChecks":["Validate touched auth/security/database paths with domain owners.","Review blast-radius components for transitive side effects.","Use risk override only with an explicit mitigation plan."]}}

---

Generated by diagram-cli

[jscraik]

reopen to refresh stale pr-template payload

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.