build: migrate from aube to pnpm

[ThomasK33]

Why

Dependabot cannot update aube-lock.yaml. Its PRs (for example #173) change only package.json, then every CI job fails at aube ci because the lockfile is out of date. This PR moves the repo to pnpm so dependency bots work again.

Base note: this was planned on top of #175. #175 merged before this PR opened (main has the same tree as that branch), so the PR targets main directly.

What changed

1. Lockfile. aube-lock.yaml → pnpm-lock.yaml. aube already writes pnpm's lockfile v9 format, so I copied the file and ran pnpm install. No resolved version changed (every package name in both lockfiles resolves to the same versions). pnpm also records all platform variants of optional native bindings (esbuild, oxlint, oxfmt, rolldown, lightningcss) plus the wasm fallback's deps (@emnapi/*, @napi-rs/wasm-runtime, @tybys/wasm-util, tslib). supportedArchitectures still limits which ones get installed. aube's extra vite importer entry (an auto-installed peer) is gone, as are release-please's peer suffixes.
2. package.json. packageManager: pnpm@10.34.5. Top-level overrides moved to pnpm.overrides (same 8 pins). pnpm.allowBuilds became pnpm.onlyBuiltDependencies (same list).
3. pnpm-workspace.yaml. Keeps supportedArchitectures and trustPolicyExclude. Adds minimumReleaseAge: 1440 and trustPolicy: no-downgrade so we keep the supply-chain checks that aube ran by default.
4. mise. "npm:pnpm" = "10.34.5" replaces aube. npm.package_manager = "npm" makes mise install it with npm. Tasks: bootstrap = pnpm install && pnpm exec playwright install chromium, bootstrap-ci = pnpm install --frozen-lockfile, audit = pnpm audit --audit-level high. In mise.lock, the aube block became an npm:pnpm entry. I edited it by hand because mise lock deletes the task-level ffmpeg conda entries.
5. Workflows. ci.yml (edited by hand): the macOS job installs npm:pnpm in place of aube. release.yml has a comment fix only. The other workflows already go through mise run bootstrap-ci.
6. New .github/dependabot.yml for npm (pnpm) and github-actions, weekly, with a 7-day cooldown. 7 days is zizmor's minimum, and it is longer than minimumReleaseAge.
7. Docs. AGENTS.md, docs/CONTRIBUTING.md, docs/INSTALL.md, ADR 0009 and .mux/init. I left CHANGELOG.md and the archived plans/ as they are, because they record history.

Design choices

• pnpm 10, not 11 or 12. GitHub's Dependabot docs list pnpm v7–v10 as supported. pnpm v11 support was closed as done only on 2026-09-15 (dependabot-core#14794), and follow-up bugs are still open (for example #15904).
• npm build of pnpm, not the standalone binary. node-pty 1.1.0 has no Linux prebuilds, so its install script runs node-gyp rebuild. The npm build of pnpm bundles node-gyp; mise's standalone aqua:pnpm/pnpm binary does not, so the install fails with node-gyp: not found. aube used to download node-gyp on its own.

Validation

• Clean frozen install: rm -rf node_modules && mise run bootstrap-ci passed. I also ran it with an empty store and no side-effects cache (pnpm install --frozen-lockfile --store-dir <new> --config.side-effects-cache=false); node-pty compiled with gyp info ok.
• mise run ci passed (exit 0; 159/159 test files). The first run hit the known test/e2e/export-fixtures.test.ts flake under host load (a wait exited 4). npx vitest run --retry=2 test/e2e/export-fixtures.test.ts passed on its own (5/5), and the full mise run ci rerun was green.
• mise run --force format-check, workflow-lint, build, install-smoke (tarball route) and validate-bundles all passed.
• pnpm audit --audit-level high: 0 high or critical (1 moderate).
• npm run version:json printed ok: true with cliVersion 0.5.0.
• Dogfood with an isolated AGENT_TTY_HOME: create, run 'echo pnpm-migration-ok', wait --text, snapshot, screenshot and destroy, all --json with ok: true:

Risks and open questions

• Release pipeline not run. release.yml, release-please.yml and npm publish only run on tags or dispatch. They use the same mise run bootstrap-ci and mise run ci paths tested here, and publishing still uses npm publish <tarball>.
• macOS CI only runs in Actions. node-pty uses its darwin prebuilds there.
• The mise.lock entry for npm:pnpm pins the version with no checksum. The mise npm backend records no checksum; the aqua backend did, but it cannot build node-pty.
• Dependabot is untested until it runs on main.
  • Security updates skip the cooldown. A fix published less than a day earlier could hit minimumReleaseAge; pnpm resolves an older version, so the PR may fail or do nothing. minimumReleaseAgeExclude is the escape hatch.
  • pnpm.* settings in package.json work in pnpm 10. pnpm 11+ ignores them, so they must move to pnpm-workspace.yaml when we upgrade.
• Harmless npm warn Unknown env config lines during install. pnpm exports npm_config_* variables, and prepare calls npm run build, which warns about them.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high