fix(ci): one package manager, one lockfile — publish uses pnpm

[VickyXAI]

The trap

package.json declares "packageManager": "pnpm@9.15.4" and ci.yml runs pnpm install --frozen-lockfile — but publish.yml ran npm ci against a second lockfile nothing else read.

So a package.json change could pass CI and still kill the publish. That is exactly how v3.6.0 died:

npm error Invalid: lock file's @blockrun/clawrouter@0.12.220
          does not satisfy @blockrun/clawrouter@0.12.223

CI was green (pnpm-lock.yaml synced) while npm's lockfile still pinned 0.12.220 — the very bundle that broke every consumer for four days. The release published nothing, and since the trigger is release: published with no workflow_dispatch, a re-run just re-checked-out the same bad tag. 3.6.1 had to be cut instead.

Two lockfiles means two sources of truth and one of them is only exercised at release time — the worst possible moment to discover it drifted.

The fix

• publish.yml installs with pnpm, matching ci.yml and the declared packageManager
• pack/publish stay on npm — they read package.json, not a lockfile, and npm publish --provenance is what wires the OIDC attestation
• package-lock.json deleted and gitignored, so the second source of truth cannot come back

Verified

Ran the publish job's exact sequence with only pnpm-lock.yaml present:

pnpm install --frozen-lockfile  ✓
pnpm run build                  ✓
npm pack --dry-run              ✓
  → @blockrun/llm@3.6.1, 7 files, 695KB
  → peerDependencies: {"@blockrun/clawrouter":"^0.12.222"}
  → peerDependenciesMeta: {"@blockrun/clawrouter":{"optional":true}}   ← intact

197 tests, typecheck green.