Restore .pnpmfile.mjs workaround to fix broken CI

[xxczaki]

Problem

main CI (Build and deploy) and Release have been failing since commit 21a9105 "Remove obsolete .pnpmfile.mjs workaround":

• Release: [ERROR] Error during pnpmfile execution ... Cannot find module '.../.pnpmfile.mjs' during pnpm install --frozen-lockfile.
• Build and deploy: failed to compute cache key: "/.pnpmfile.mjs": not found (the Dockerfile still COPYs the file).

All subsequent Renovate PRs also branch off this broken state.

Root cause

The removal commit assumed pnpm 11.6.0 no longer auto-loads a pnpmfile via configDependencies (@pnpm/plugin-esm-node-path). That assumption is wrong for this version: pnpm still writes a pnpmfileChecksum into pnpm-lock.yaml, so frozen installs and the Docker build still try to load the now-deleted .pnpmfile.mjs and crash with ERR_MODULE_NOT_FOUND.

Fix

• Restore the empty-hooks .pnpmfile.mjs workaround.
• Revert the lockfile pnpmfileChecksum to the value matching the restored file.

Verified locally that pnpm install --frozen-lockfile now passes (it failed before this change). This returns main to green; outstanding Renovate PRs can then be rebased.

🤖 Generated with Claude Code

[xxczaki]

Weekly maintenance sweep (2026-07-27) – re-confirmed this is still the single root cause blocking the whole repo.

main (21a9105) has had no commits since 2026-06-13, and every open Renovate PR is red on Run Tests with:

[ERR_PNPM_LOCKFILE_CONFIG_MISMATCH] Cannot proceed with the frozen installation.
The current "pnpmfileChecksum" configuration doesn't match the value found in the lockfile

Refined evidence:

• Renovate-regenerated lockfiles drop the pnpmfileChecksum line entirely (verified on renovate/ai-6.x and renovate/snazzah-davey-0.x), while CI computes a non-empty checksum from the @pnpm/plugin-esm-node-path config dependency – hence the mismatch.
• PR Update actions/checkout action to v7 #681 (actions/checkout v7) is the one green Renovate PR, because it touches only workflow files and never regenerates the lockfile. That confirms the breakage is lockfile-checksum drift rather than the dependency bumps themselves.
• Every Renovate PR that landed before 21a9105 was green with .pnpmfile.mjs present, so restoring it returns the repo to a known-good state.

This branch is still green and mergeable. Once merged, the remaining Renovate PRs need a rebase to pick up the restored checksum.

No duplicate PR was opened; the merge decision is left to a human.