build: move the worker from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. allowBuilds and
pnpm.onlyBuiltDependencies collapse into package.json#allowScripts, which npm
11 gates the same way; sharp is omitted because it is not in the tree.

cloudflare-worker/.github/workflows/ci.yml is updated for consistency even
though it never runs: GitHub only reads workflows from the repository root.

cloudflare-worker/README.md

@@ -63,7 +63,7 @@ Each fire shows up in *History* with status code and response body — open `cla
 ```bash
 git clone https://github.com/tiennm99/claude-code-routine-trigger
 cd claude-code-routine-trigger/cloudflare-worker
-pnpm install
+npm install
 
 # Upload secrets (from Anthropic routine editor → API trigger)
 echo -n 'https://api.anthropic.com/v1/claude_code/routines/trig_.../fire' \
@@ -153,7 +153,7 @@ curl "http://localhost:8787/__scheduled?cron=*+*+*+*+*"
 ### Tests
 
 ```bash
-pnpm test
+npm test
 ```
 
 Vitest runs in the Workers runtime via `@cloudflare/vitest-pool-workers`. Tests mock `fetch`, so they consume no Anthropic quota.