Updated pnpm to 11.4.0 (#28197)

no ref

Updating pnpm 10.33>11.4.0:
- Stops reading the `pnpm` field from `package.json`. `overrides`,
`packageExtensions`, and `onlyBuiltDependencies` (renamed to
`allowBuilds`) now live in `pnpm-workspace.yaml`.
- Stops reading non-auth/registry keys from `.npmrc`.
- Replaces the millions of `index/*.json` files in the store with a
single SQLite `index.db` (v11 store format) — faster lookups, fewer
syscalls.
- New supply-chain defaults: `minimumReleaseAge: 1440` (1 day) and
`blockExoticSubdeps: true`.

Node version requirement is unchanged for us (already on 22.18.0).

## What changed

- Moved the `pnpm: {…}` block out of `package.json` into
`pnpm-workspace.yaml`.
- `onlyBuiltDependencies` (array) → `allowBuilds` (map of name →
`true`).
- Declared `minimumReleaseAge: 4320` (3 days, matches our Renovate
cadence) and `blockExoticSubdeps: true` explicitly, even though the
latter is now the default — keeps the supply-chain stance visible in the
config rather than implicit.
- Added an override redirecting `perf-primitives` to the npm-published
`^0.0.6`. `liquid-wormhole@3.0.1` (transitive in `ghost/admin`) pins
`perf-primitives` via a personal-fork git URL, which
`blockExoticSubdeps` (correctly) refuses; the override routes us to the
upstream-maintained package at the same version.
- Deleted `.npmrc` — both entries (`shamefully-hoist=false`,
`engine-strict=false`) were pnpm 11 defaults that are no longer honored
in `.npmrc` anyway.
- Regenerated `pnpm-lock.yaml` against the new policies under pnpm 11's
v11 store.