fix(deps): actually track pnpm-lock.yaml

Earlier commit 26fbb67 "swap to pnpm-lock.yaml as source of truth"
untracked package-lock.json but pnpm-lock.yaml never made it in —
a global ~/.gitignore excludes pnpm-lock.yaml across all repos. The
lockfile was silently un-tracked the whole time.

Fix: add !pnpm-lock.yaml to the repo's .gitignore to override the
global rule, then stage the lockfile.

Verified: git check-ignore now reports .gitignore:11:!pnpm-lock.yaml.

.gitignore

@@ -6,6 +6,10 @@ build/
 # pnpm is the package manager — npm's lockfile is not the source of truth
 package-lock.json
 
+# Un-ignore pnpm-lock.yaml (global gitignore excludes it; this repo tracks it
+# as the source of truth for reproducible installs + supply-chain provenance)
+!pnpm-lock.yaml
+
 # Cloudflare Workers
 .wrangler/
 .dev.vars