fix(docker): pin pnpm via corepack instead of installing the latest

[squarezw]

What happened

CI went red on 2026-08-05 with nothing changed in the repo:

[ERROR] Cannot verify the identity of the @pnpm/exe.linux-x64 native binary:
        it is missing from pnpm-lock.yaml

RUN npm install -g pnpm is unpinned, so every build installed whatever pnpm was newest at that moment. The 08-03 build was fine; by 08-05 pnpm 11 was out, and it verifies its own native binary against the lockfile — this lockfile came from 10.26.2 (lockfileVersion: '9.0') and has no such entry.

This is the nastiest failure mode: the repo is untouched, the build breaks anyway, and when it breaks depends on someone else's release schedule. "I didn't change anything" is literally true, which is exactly why it's hard to attribute — the first instinct is to look at the last commit, and the last commit is innocent.

The fix

package.json already declares packageManager: pnpm@10.26.2 (with a sha512). corepack reads it, so the version lives in exactly one place: bumping pnpm means editing package.json, and the Dockerfile can't drift from it.

Verified

Built the builder stage locally — pnpm install --frozen-lockfile succeeds, next build completes, and pnpm --version inside the image reports 10.26.2, matching packageManager. Not just "the build went green": the pinned version was confirmed in the image.

The same one-line problem exists in the private deployment repo and is fixed there identically, so the two Dockerfiles stay byte-identical in that block.

🤖 Generated with Claude Code

[squarezw]

改用另一条路：不动 Dockerfile，改为把 lockfile 升到 pnpm 11（CI 装的就是最新版）。