build: move from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. allowBuilds for esbuild becomes
package.json#allowScripts. The Dockerfile installs with npm ci --omit=dev and
no longer prepares pnpm through corepack; .npmrc keeps engine-strict, which npm
honours natively.

minimumReleaseAgeExclude is dropped rather than translated: pnpm's
minimumReleaseAge was never set, so the 30-entry exclusion list had nothing to
exclude from. Direct dependency versions resolve identically to the pnpm
lockfile.

renderer/scripts/render-local.js

@@ -4,7 +4,7 @@ import {renderWheelGif} from '../src/render/render-gif.js';
 import {parseRenderLocalArgs} from './render-local-args.js';
 
 const usage = `Usage:
-  pnpm render:local -- --option <text> --option <text> [options]
+  npm run render:local -- --option <text> --option <text> [options]
 
 Options:
   -o, --output <path>   Output file (default: wheel.gif)