chore(deps): pin pnpm 11.17.0 -> 11.18.0 (#53) (#68)

Deferred on 2026-07-29 purely so the release would clear the 24-hour
cooldown rather than waive it. 11.18.0 published 2026-07-29T07:50:16Z and
was 32.7h old at the bump, and is still `latest` - so the wait cost
nothing and no bypass was needed.

`pnpm-workspace.yaml` is untouched and no `minimumReleaseAgeExclude`
block appears anywhere in the diff, which was the point of waiting.

One correction to the issue's acceptance criteria: it predicted the
lockfile would not move. It does, by 38 lines - but every one of them is
pnpm's own `packageManagerDependencies` entry and its seven platform
binaries (`@pnpm/exe`, `@pnpm/linux-arm64`, ...). pnpm 11 tracks the
package manager it self-downloads in the lockfile, so a version change
there is expected. No project dependency re-resolved; verified by
filtering the diff for any non-`@pnpm/` package line, which returns
nothing. That distinction matters here because transitive re-resolution
is the thing that has broken `vp check` with TS2321 before.

Gate: `pnpm run verify` green under 11.18.0 - 1255 passed / 3 skipped
(app, up from the issue's 1249 baseline as tests landed since), 12
(worker), 3 (container). `pnpm --version` prints 11.18.0 via
`onFail: download`.

Claude-Session: https://claude.ai/code/session_01BkKb3S2cGyRFFHSzuCQBgj

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: wormeyman

package.json

@@ -43,7 +43,7 @@
   "devEngines": {
     "packageManager": {
       "name": "pnpm",
-      "version": "11.17.0",
+      "version": "11.18.0",
       "onFail": "download"
     }
   },