build: move from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. allowBuilds for esbuild becomes
package.json#allowScripts. The Dockerfile installs with npm ci --omit=dev and
no longer prepares pnpm through corepack; .npmrc keeps engine-strict, which npm
honours natively.

minimumReleaseAgeExclude is dropped rather than translated: pnpm's
minimumReleaseAge was never set, so the 30-entry exclusion list had nothing to
exclude from. Direct dependency versions resolve identically to the pnpm
lockfile.

renderer/docs/render-benchmarks.md

@@ -3,7 +3,7 @@
 Fill this after running:
 
 ```sh
-pnpm render:fixtures
+npm run render:fixtures
 ```
 
 | Fixture | Size | FPS | Duration | Bytes | Render Time | Notes |