chore(repo): upgrade pnpm baseline to 12.2.1

[ckken]

Scope

• Changed areas: root pnpm baseline, workspace security/build policy, CI and publish setup, release guards, CLI doctor/scaffolding, docs, and version-contract tests.
• Protected areas not touched: no package versions under packages/cdn-* or packages/lib-*; publish workflow change is limited to the explicitly requested pnpm setup version; apps/** change is limited to the acceptance runner's pinned pnpm command.
• User-visible behavior: repository and newly generated EMP workspaces use [email protected] with pnpm 12.x; emp doctor validates pnpm 12.

pnpm 12 migration boundaries

• Migrated ignoredBuiltDependencies to explicit allowBuilds: false, preserving the existing denied build-script set under pnpm 12's strict dependency-build policy.
• Kept the default 24-hour publication-age policy. Only the already-reviewed locked versions @rstest/[email protected] and @rstest/[email protected] are exempted with exact selectors.
• Set pmOnFail: ignore so pnpm 12 does not prepend an environment lockfile document that hides the real dependency graph from single-document scanners. CI, release guards, doctor, templates, and tests still enforce the 12.2.1 / 12.x baseline.
• pnpm-lock.yaml remains byte-identical and single-document after a frozen pnpm 12 install.

Directory Boundary Check

• apps/** changes are limited to the acceptance contract required by this package-manager migration.
• I did not modify packages/cdn-* or packages/lib-* version lines.
• I did not create or continue repo-local historical workflow directories.
• I did not commit generated output, caches, or local indexes.

Validation

• corepack pnpm install --frozen-lockfile with pnpm 12.2.1; lockfile hash unchanged and supply-chain policy passed.
• corepack pnpm workflow:check
• git diff --check
• corepack pnpm test:rules — 6 files, 51/51 tests.
• corepack pnpm --silent deps:core:check -- --format json — 14/14 CURRENT.
• corepack pnpm ci:verify
• corepack pnpm empbuild
• corepack pnpm apps:acceptance — 14/14 app builds and library-output smoke passed.
• Independent read-only verification passed, including lockfile hash stability and policy-set equivalence.

Release Safety

• CI workflow contains no NODE_AUTH_TOKEN, npm publish, or release:publish.
• Release scope excludes apps/** and website/**.
• corepack pnpm release:publish:dry -- --skip-build passed for the 17 core packages.

Review

• CODEOWNERS review requested by repository routing.
• Reviewer can reproduce the validation commands from this PR.
• No required local verification was skipped. GitHub CI is the remaining remote gate.