ci: pin pnpm to 10.17.1 across workflows

pnpm/action-setup with version:latest resolved to pnpm 11, which fails
the install step (exit 1) by no longer honoring ignoredBuiltDependencies
the way the pnpm-10-generated lockfile expects. Pin a single tested
version everywhere to match local development.

- Add packageManager field as the source of truth
- npm-publish.yml: version latest -> 10.17.1
- run-tests.yml: version 8 -> 10.17.1 (also fixes reading the pnpm-10 lockfile)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: tianzhou

.github/workflows/npm-publish.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v3
         with:
-          version: latest
+          version: 10.17.1
 
       # Install project dependencies
       - name: Install dependencies

.github/workflows/run-tests.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v2
         with:
-          version: 8
+          version: 10.17.1
           run_install: false
 
       - name: Setup Node.js
@@ -65,7 +65,7 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v2
         with:
-          version: 8
+          version: 10.17.1
           run_install: false
 
       - name: Setup Node.js

package.json

@@ -36,6 +36,7 @@
   "engines": {
     "node": ">=22.5.0"
   },
+  "packageManager": "pnpm@10.17.1",
   "keywords": [],
   "author": "",
   "license": "MIT",