Replace pnpm-lock.yaml with package-lock.json. pnpm-workspace.yaml's allowBuilds becomes package.json#allowScripts, which npm 11 gates the same way, listing only the packages actually present in the tree.
