Fixed pack.js and Dockerfile references to deleted .npmrc (#28205)

ref #28197

Five distinct release-pipeline files broke after the
`.npmrc` deletion, but the deeper story is that `.npmrc` was also
carrying `frozen-lockfile=false`, which was silently absorbing several
pnpm-deploy-vs-lockfile mismatches under pnpm 10. pnpm 11 ignores
`.npmrc` for that directive, so the mismatches surface.

## What was broken

- `Dockerfile.production:28` — production image builds. `COPY` fails on
missing source.
- `docker/ghost-dev/Dockerfile:21` — devcontainer + local dev. Already
failed on main: [run
26525156893](https://github.com/TryGhost/Ghost/actions/runs/26525156893).
- `ghost/core/scripts/pack.js:124` — read root `.npmrc` to build the
published Ghost tarball; would throw on next release.
- `pack.js` — `pnpm pack` of `@tryghost/i18n`/etc. needs
`pnpm-workspace.yaml` in scope (pnpm 11 strict-validates `catalog:`
refs); pack.js wrote it AFTER the pack loop.
- `pack.js` — the shipped tarball's `pnpm-workspace.yaml` carried
`overrides` + `packageExtensions` verbatim from root, but `pnpm
deploy`'s generated lockfile doesn't record them (they're already
applied to the resolved package.json). pnpm 11's frozen-lockfile install
(CI=true default for ghost-cli) failed
`ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`.
- `pack.js` — after the existing peer-suffix-stripping and
component-file: rewriting on the deployed package.json, the deploy
lockfile no longer matched. Under pnpm 10 this was masked by
`frozen-lockfile=false` in `.npmrc`; pnpm 11 fails
`ERR_PNPM_OUTDATED_LOCKFILE`.
- `pack.js` — `minimumReleaseAge` policy in the shipped workspace.yaml
404'd on the private component tarballs and failed install inside
`Dockerfile.production`.