chore: Migrate from npm to pnpm (#134)

Migrate from npm to pnpm for supply chain protection and org standardization.

- minimumReleaseAge: 10080 (7 days) prevents installing recently-published packages
- packageManager field pins pnpm version
- CI workflows updated to use pnpm/action-setup v5 (pinned to commit hash)

Author: erezrokah

.github/workflows/ci.yml

@@ -15,14 +15,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Install pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          cache: "npm"
+          cache: 'pnpm'
           node-version: "24"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Build code
         run: |
-          npm run build
+          pnpm run build

.github/workflows/publish.yml

@@ -14,16 +14,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Install pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Build code
         run: |
-          npm run build
+          pnpm run build
 
-      - run: npm publish --access public
+      - run: pnpm publish --access public

.github/workflows/regen.yml

@@ -22,18 +22,20 @@ jobs:
           permission-pull-requests: write
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Install pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          cache: "npm"
+          cache: 'pnpm'
           node-version: "24"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Generate code
         run: |
-          npm run proto-clone
-          npm run proto-all
+          pnpm run proto-clone
+          pnpm run proto-all
 
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8