fix(ci): pin pnpm 10.33 and approve esbuild build scripts

Corepack was resolving pnpm to latest (11.0.9) on each CI run, and
pnpm 11 refuses unapproved postinstall scripts in --frozen-lockfile
mode. That caused ERR_PNPM_IGNORED_BUILDS: esbuild@0.25.12 and failed
the web image build in publish-images.

Changes:
- web/package.json: pin packageManager to pnpm@10.33.0
- web/pnpm-workspace.yaml: approve esbuild via onlyBuiltDependencies
  (pnpm 10 syntax; matches the pinned major)
- web/Dockerfile: copy pnpm-workspace.yaml before pnpm install so the
  approval list is visible inside the build stage

web/Dockerfile

@@ -1,7 +1,7 @@
 FROM node:22-alpine AS build
 RUN corepack enable
 WORKDIR /app
-COPY package.json pnpm-lock.yaml ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 RUN pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build

web/package.json

@@ -3,6 +3,7 @@
   "private": true,
   "version": "0.1.0",
   "type": "module",
+  "packageManager": "pnpm@10.33.0",
   "scripts": {
     "install:ci": "pnpm install --frozen-lockfile",
     "dev": "vite",

web/pnpm-workspace.yaml

@@ -0,0 +1,5 @@
+packages:
+  - '.'
+
+onlyBuiltDependencies:
+  - esbuild