chore(ci): revisit pnpm pin once v11 audit uses the bulk advisory endpoint

[rickcedwhat-ai]

Context

.github/workflows/pr-checks.yml pins pnpm/action-setup@v6 to version: 10.33.2 in all three jobs (see commit 2ce1a8f, PR #359).

Why: without an explicit version, action-setup@v6 installed the latest pnpm (v11) in CI, ignoring the packageManager: pnpm@10.33.2 declared in package.json. pnpm v11's audit calls npm's retired quick-audit endpoint, which returns HTTP 410:

ERR_PNPM_AUDIT_BAD_RESPONSE ... /-/npm/v1/security/audits/quick responded with 410:
"This endpoint is being retired. Use the bulk advisory endpoint instead."

pnpm 10.33.2 uses a working endpoint (verified locally: exit 0, no vulnerabilities), so pinning to the declared version fixed the "Audit Dependencies" step.

Why this is a temporary pin

• It holds CI back on pnpm 10 while the rest of the ecosystem moves to v11.
• The version is duplicated in three action-setup steps with a "keep in sync with packageManager" comment. Dependabot updates uses: refs but not with: version inputs, so a pnpm bump means editing four places (packageManager + 3 steps) — easy to drift.

What to do when picking this up

1. Check whether current pnpm v11 audit uses the bulk advisory endpoint (/-/npm/v1/security/advisories/bulk). Track the pnpm audit-endpoint issue upstream.
2. If fixed: remove the three version: 10.33.2 pins (let action-setup read packageManager), bump packageManager to the desired pnpm, and confirm the audit step passes in CI.
3. If not fixed and you still want to move to pnpm v11: replace pnpm audit --prod --audit-level=high with a version-independent scan against the working endpoint (e.g. osv-scanner, or an audit tool that targets the bulk advisory API) so the security gate keeps working.

Acceptance

• No hardcoded pnpm version duplicated across workflow steps (or a documented single source of truth), AND
• the dependency-audit gate runs against a non-retired endpoint on the intended pnpm version.

Related: #359 (where the failure surfaced and the pin landed).