build: move the worker from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. allowBuilds and
pnpm.onlyBuiltDependencies collapse into package.json#allowScripts, which npm
11 gates the same way; sharp is omitted because it is not in the tree.

cloudflare-worker/.github/workflows/ci.yml is updated for consistency even
though it never runs: GitHub only reads workflows from the repository root.

cloudflare-worker/package.json

@@ -5,20 +5,20 @@
   "type": "module",
   "private": true,
   "license": "Apache-2.0",
-  "packageManager": "pnpm@11.1.1",
   "main": "worker.js",
   "scripts": {
     "dev": "wrangler dev",
     "deploy": "wrangler deploy",
     "test": "vitest run"
   },
-  "pnpm": {
-    "onlyBuiltDependencies": ["esbuild", "sharp", "workerd"]
-  },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.18.8",
     "vite": "^8.0.14",
     "vitest": "^4.1.10",
     "wrangler": "^4.114.0"
+  },
+  "allowScripts": {
+    "esbuild": true,
+    "workerd": true
   }
 }