[danmano411]

Fix pnpm install trap: migrate lockfile to v9 and pin pnpm 12

GitHub issue number: #7

What user problem are we solving?

frontend/pnpm-lock.yaml was written by pnpm 8 (lockfile format v6.0). Current pnpm (12.x) can't use a v6 lockfile, so a fresh pnpm install re-resolves every dependency and rewrites the lockfile (about 14,000 changed lines). It also stops on two dependency install scripts it hasn't been told about (es5-ext, protobufjs). Every new member hits this on day one. CI also disagreed with itself: node.js.yml pinned pnpm 8, while frontend.yml installed whatever pnpm was newest and then ran --frozen-lockfile.

What solution does this PR provide?

• Converts the lockfile to the v9 format using pnpm 9. It's a format-only change: all 1,107 package versions stay the same, whereas running pnpm 12 directly would have changed 555 of them.
• Pins pnpm 12.11.2 with packageManager, so local installs and CI all use the same version.
• Moves CI and the README to pnpm 12 and Node 22, since Node 20 reached end-of-life in April 2026.

Testing Methodology

• On Node v22.23.2 and pnpm 12.11.2, a fresh pnpm install --frozen-lockfile with no node_modules succeeds with no errors or warnings and leaves the lockfile unchanged. pnpm lint and pnpm test both pass.
• The sorted list of name@version entries is identical in the old v6 lockfile and the new v9 lockfile, 1,107 each.
• CI on this branch passed: Frontend Workflow Check and React Build Check, installing with pnpm v12.11.2 on Node 22.x.

Any other considerations

• Contributors need to run corepack enable once, or install pnpm 12 globally.
• An older global pnpm won't work: pnpm 8 stops with ERR_PNPM_INVALID_WORKSPACE_CONFIGURATION on the new pnpm-workspace.yaml.

Closes #7

Assisted-by: Claude Code (Opus 5.5)

---

Note

Low Risk
Tooling, lockfile format, and CI/doc updates only; no application runtime or security-sensitive logic changes in the shown diff.

Overview
Fixes the fresh pnpm install trap where modern pnpm could not use the old v6 lockfile, re-resolved dependencies, and blocked on install scripts for es5-ext and protobufjs.

frontend/package.json now pins pnpm@12.11.2 via packageManager and declares engines.node >=20. A new pnpm-workspace.yaml sets allowBuilds for those two packages so pnpm 12 can install without prompting. The lockfile is upgraded to format v9 (same resolved package set as before, per the PR intent).

GitHub Actions (frontend.yml, node.js.yml) standardize on Node 22.x and pnpm/action-setup@v4, reading the pinned version from frontend/package.json instead of mixing global npm install -g pnpm and a hardcoded pnpm 8 pin. README.md prerequisites match (Node 22 LTS, Corepack + pinned pnpm). .github/Architecture.md is a documentation tree reorder only.

^{Reviewed by Cursor Bugbot for commit f98d655. Bugbot is set up for automated code reviews on this repo. Configure here.}

[alessiopagliarulo]

Thanks Dan, verified: all frontend checks (lint, test, build, prettier) pass on the latest commit. Merging.