[codex] Support pnpm 11 build approvals

[wimi321]

Summary

• Migrate dependency build-script approvals from the removed package.json#pnpm.onlyBuiltDependencies setting to pnpm-workspace.yaml#allowBuilds.
• Add a contract test so pnpm 11 compatibility does not regress.

Root cause

During comprehensive local testing, pnpm 11 refused to continue because it no longer reads pnpm.onlyBuiltDependencies from package.json. It auto-added placeholder allowBuilds entries and failed with ERR_PNPM_IGNORED_BUILDS. The official pnpm 11 guidance is to use allowBuilds in pnpm-workspace.yaml instead.

Validation

• node --test tests/*.test.mjs before the fix: 192 passed
• pnpm test after the fix: 193 passed
• pnpm typecheck
• pnpm build
• pnpm check:release-quality
• pnpm website:build
• pnpm rc:check
• pnpm rc:artifacts
• node scripts/release_artifact_smoke.mjs
• node scripts/check_no_lite_release_assets.mjs
• node scripts/check_nvidia_release_assets.mjs
• node scripts/check_release_notes_i18n.mjs
• node scripts/package_artifact_smoke.mjs --mode=dev
• node scripts/smoke_windows_packaged_app.mjs --mode=full --require-katago --exe=.tmp/user-download-v0.4.17/standard-portable/GoAgent.exe
• node scripts/smoke_windows_packaged_app.mjs --mode=nvidia --require-katago --exe=.tmp/user-download-v0.4.17/nvidia-portable/GoAgent.exe
• git diff --check

Notes: RC dev checks emitted only expected local-environment warnings for missing release KataGo assets, signing evidence, Windows real-machine smoke evidence, and visual QA evidence. The actual v0.4.17 Windows portable packages were smoke-tested from the downloaded/extracted user assets and both passed with katagoReady=true.