🐛 Fixed production builds using unpinned dependencies (#28240)

ref https://github.com/TryGhost/Ghost/commit/5b6eba0fbd790edd6bab0d10de76aca74a4e7a57

- preserved root `pnpm-workspace.yaml` `overrides` and
`packageExtensions` in the Ghost deploy archive
- kept the pnpm 11 lockfile regeneration flow so frozen production
installs remain valid
- added validation that packaged archives include root overrides

## Why

The pnpm 11 archive flow was writing a trimmed deploy workspace that
dropped root overrides. That let production archives resolve a different
dependency graph from the source workspace, including changed versions
for packages such as `@tryghost/errors`, `moment-timezone`, `juice`, and
other transitive dependencies.