fix(sdk): give sdk/ts a pnpm lockfile so CI stops resolving from the registry

[acamarata]

fix(sdk): give sdk/ts a pnpm lockfile so CI stops resolving from the registry

sdk/ts carried only a package-lock.json, and every workflow installs it with
pnpm:

cd sdk/ts && pnpm install --frozen-lockfile=false

pnpm does not read package-lock.json. With no pnpm-lock.yaml present and the
frozen check disabled, every CI run resolved dependencies fresh from the
registry. Nothing pinned them. Two consequences:

• The build was not reproducible, and a compromised patch release of any
  transitive dependency would land silently on the next run.
• Dependabot's alerts against sdk/ts/package-lock.json pointed at a file that
  governed nothing. Updating it would not have changed a single installed byte.

This replaces it with a real pnpm-lock.yaml and switches the three installs to
--frozen-lockfile. GCI is pnpm-only for JS/TS, so the npm lockfile should not
have been the one committed here; sdk/ts-sdk next door already does it correctly.

The generated lockfile also happens to clear the four alerts that were filed
against the npm one:

qs           npm-lock 6.15.1  ->  6.16.0   (fix >= 6.16.0)
@babel/core  npm-lock 7.29.0  ->  7.29.7   (fix >= 7.29.6)
body-parser  npm-lock 1.20.5  ->  1.20.8   (fix >= 1.20.6)

Verified in the worktree: pnpm install --frozen-lockfile exits 0 — the flag CI
will now use — and pnpm test passes, 3 suites, 18 tests.

The other non-frozen installs in this repo (sdk-ts-sdk-publish.yml's
pnpm install --frozen-lockfile || pnpm install) are left alone; that directory
has a valid lockfile and the fallback is a separate question.