Migrate to pnpm 11

[Garbee]

Goal

Switch this repo's package manager to pnpm 11.

Current state

• Current lockfile: package-lock.json
• Workspaces monorepo: no
• packageManager field: not set

Notes specific to this repo

JS tooling supports a Ruby gem. The gem publish path itself is unaffected. Also review prepare_release.sh if it shells out to npm or yarn.

Migration checklist

• Remove package-lock.json
• Run pnpm import to seed pnpm-lock.yaml from the prior lockfile's resolutions
• Add "packageManager": "pnpm@11.x.x" to root package.json
• Commit pnpm-lock.yaml
• Update .gitignore if needed
• Update .github/dependabot.yml per the api-team:dependabot-config skill

CI / deploy pipeline considerations

The following workflows exist in this repo and need a review pass; treat the list as a starting point — open the repo and confirm nothing was missed:

• .github/workflows/create-release-candidate.yml
• .github/workflows/create-release.yml
• .github/workflows/update-axe-core.yml
• Each workflow's actions/setup-node block updated to cache: 'pnpm' (pnpm-lock.yaml must be committed in the same commit so the cache key resolves)
• Every npm ci / npm install / yarn install replaced with pnpm install --frozen-lockfile
• Release / publish workflows — registry publish remains npm publish (pnpm doesn't change that); verify any script wrapper that shells out
• Downstream consumers of build artifacts — verify the output is byte-identical so anything depending on it keeps working

Acceptance criteria

• Migration PR merges with CI green
• A release / deploy run (or canary) confirms the pipeline still ships
• pnpm install --frozen-lockfile succeeds locally on a clean checkout

References

• practices/dependencies.md
• plugins/api-team/skills/dependabot-config/SKILL.md
• plugins/api-team/skills/github-actions-workflow/SKILL.md