Replace pnpm-lock.yaml with package-lock.json. allowBuilds and
pnpm.onlyBuiltDependencies collapse into package.json#allowScripts, which npm
11 gates the same way; sharp is omitted because it is not in the tree.
cloudflare-worker/.github/workflows/ci.yml is updated for consistency even
though it never runs: GitHub only reads workflows from the repository root.