build: move from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. pnpm-workspace.yaml's
allowBuilds becomes package.json#allowScripts, which npm 11 gates the same way,
listing only the packages actually present in the tree.

.github/workflows/ci.yml

@@ -10,13 +10,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
           node-version: '24'
-          cache: 'pnpm'
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm test
-      - run: pnpm exec wrangler deploy --dry-run
+          cache: 'npm'
+      - run: npm ci
+      - run: npm test
+      - run: npx wrangler deploy --dry-run
         env:
           CLOUDFLARE_API_TOKEN: dummy