Fix broken deploy and dependabot CI checks

[wrynearson]

Summary

• Bump pnpm/action-setup in deploy.yml from 9 to 10, matching ci.yml. Version 9 doesn't understand a pnpm-workspace.yaml without a packages: key (added in Add AOI upload with map-view-aware pass counting #130), so every scheduled deploy since has failed at pnpm install with packages field missing or empty.
• Add pnpm-lock.yaml to .prettierignore. Dependabot regenerates the lockfile without running Prettier, so pnpm format:check has been failing on every npm dependabot PR since May (Bump @radix-ui/react-slot from 1.2.3 to 1.3.3 #119, Bump pmtiles from 4.3.0 to 4.4.1 #118, Bump typescript from 5.9.2 to 5.9.3 #117, Bump @vitejs/plugin-react from 5.0.3 to 5.2.0 #116, Bump eslint-plugin-react-refresh from 0.4.20 to 0.5.3 #115).
• Fix the ruff 0.16.1 lint errors introduced on main by Bump ruff from 0.15.10 to 0.16.1 in /scripts #126 (unused unpacked variables, datetime.UTC alias, explicit subprocess.run(check=...), and a missing executable bit matching the shebang in validate_satellites.py).

Test plan

• uv run ruff check passes
• uv run ruff format --check passes
• uv run python validate_satellites.py passes
• pnpm format:check passes

🤖 Generated with Claude Code

[claude]

Claude finished @wrynearson's task in 53s —— View job

---

Reviewing PR #131

• Gather context (diff, changed files)
• Review correctness/security/best-practice issues
• Ponytail pass for over-engineering
• Post final review

---

✅ No blocking issues — safe to merge.

• deploy.yml pnpm version bump to 10 now matches ci.yml, which fixes the pnpm-workspace.yaml packages: field error.
• .prettierignore addition correctly excludes the dependabot-regenerated lockfile from prettier --check.
• generate_satellite_paths.py / validate_satellites.py changes are mechanical ruff 0.16.1 fixes (unused-var prefixing, datetime.UTC, PEP 604 X | None typing, executable bit) and are behavior-preserving.

One non-blocking observation:

• scripts/generate_satellite_paths.py:507 — the new check=False on the tippecanoe subprocess.run call preserves prior (implicit) behavior, but it means a failing/missing tippecanoe binary is silently swallowed — the script still prints "Successfully generated tiles..." and "Tiles generated successfully..." afterward (lines 508, 510) even if tile generation failed. Since this PR already had to touch this line to satisfy ruff's subprocess-run-without-check rule, it may be worth using check=True instead so pipeline failures actually fail the script/CI run:

  subprocess.run(
      [...],
      check=True,
  )

  Not a regression introduced by this PR (default was already non-raising), so not blocking.

Simplify (ponytail)

Nothing to flag — this diff is a version bump, an ignore-file entry, and mechanical linter fixes; no new abstractions or dependencies introduced.

---

💰 Estimated review cost: $0.25 · 0m52s · 13 turns