build(release): put the pinned pnpm in the dev shell the release workflow runs

[systemfsoftware-maker]

Summary

The first Release run after #230 (37706216051, on 36afef4d) failed in plan · derive phase with refused: manifest-unreadable, path: /home/runner/work/stryker-js-effect/stryker-js-effect. The dev shell had no pnpm; this adds the pinned one.

Cause

• github-release-management plan runs through nix develop. Its workspace reader, WorkspaceStoreLive in pnpm-release-management (packages/workspace-adapter/src/WorkspaceStoreLive.ts, same at our pinned 603ecb49 and at main 7f83217), spawns pnpm ls -r --json --depth=-1 (:56, from listMembers :68).
• A failed spawn is mapped to ManifestUnreadable at the repository root (:64), which is why the log names the root directory and not a package.json.
• Our dev shell had no pnpm (flake.nix comment: "pnpm is deliberately absent … corepack is the one thing allowed to resolve it"). The ubuntu runner has none either. Locally, nix develop keeps the host PATH, which has the corepack pnpm shim, so the local plan passed.
• pnpm-release-management's README already names pnpm as something the caller's dev shell must provide ("The caller's devShells.<system>.default must provide release-tools, pnpm, …"). The defect is on our side.

Fix

pkgs.pnpm_11 goes into devShells.default. That is the pnpm workspaceOf builds the tarballs with, and mkPnpmWorkspacePackages throws at evaluation unless packageManager pins exactly pnpm.version (nix/lib/pnpm-workspace-packages.nix:69-70 at 603ecb49). So the shell's pnpm can't differ from the pinned pnpm@11.27.0, which was the reason the old comment kept pnpm out. The comment is replaced.

Evidence

• Local, runner-like environment (nix develop --ignore-environment, with only host git/ssh added so ls-remote can reach origin):
  • origin/main 36afef4d: ::error::refused: manifest-unreadable, path: /tmp/rb-before, exit 1, pnpm= empty.
  • this branch: pnpm=/nix/store/…-pnpm-11.27.0/bin/pnpm, plan-release: pending_intents=20 this_cycle=0 deferred=0 -> phase=version, exit 0.
• Real runner: a temporary job in nix.yml ran the reusable workflow's two plan steps verbatim (nix build .#workspace-tarballs, then nix develop --command github-release-management plan --tarballs "$TARBALLS" --output "$GITHUB_OUTPUT") on ubuntu-latest. Run 37709084792, job 113090448636, success:

  host pnpm: absent
  11.27.0
  plan-release: pending_intents=20 this_cycle=0 deferred=0 -> phase=version
  phase=version pending_intents=20
  

  The next commit reverts that job, so the PR's diff is flake.nix only. The Release workflow was not run.
• nix flake check --no-build: all checks passed. dprint does not cover .nix; ./bin/dprint check exits 0. actionlint passes on the temporary job.
• CI on 08031c89: CI 37709084924, Nix 37709084792, Commitlint 37709084802, Changeset Check 37709085376 all passed.

Not changed

• pnpm-release-management. Its reader reporting a failed pnpm spawn as manifest-unreadable at the root hides the cause. That's a diagnostics issue in that repo, reported separately, not fixed here.
• flake.lock. Bumping pnpm-release-management to the changelog-storage fix (pnpm-release-management#36) is the next layer, once chore(release): version packages #36 merges.

Replaces #231 (same tree). A commit message there failed commitlint body-full-stop, and pushed commits are not rewritten.

Nothing was run with stryker.

[kiro-systemf]

Verified: 11/11 green on c1a4b8e; cause is WorkspaceStoreLive pnpm spawn -> ManifestUnreadable; the runner evidence run 37709084792 reached phase=version; the temp job was removed.