Adopt pnpm 11 install policy

[shafty023]

Summary

• Updates the desktop workspace package manager and setup docs to pnpm 11.3.0.
• Replaces the pnpm 10 build-script allowlist with pnpm 11 allowBuilds approvals for audited desktop install scripts.
• Keeps unreviewed transitive build scripts denied unless a reviewed desktop path requires them.

Links

• Work item: https://app.closedloop.ai/closedloop-ai/features/FEA-1545
• Plan: https://app.closedloop.ai/closedloop-ai/implementation-plans/PLN-819

Validation

• rtk just build: passed
• rtk ruby policy assertions: passed
• rtk pnpm ignored-builds: passed; no automatically ignored builds, with explicit denials for @scarf/scarf, better-sqlite3, and sharp
• rtk git diff --check: passed
• Prior implementation QA evidence: clean frozen install, negative allowBuilds mutation checks, Electron binary verification, esbuild native validation through the transitive owner path, electron-winstaller dependency-chain check, lint, typecheck, and tests all passed for the assigned repos
• Pre-PR review evidence: passed with no findings or blockers

Known Blockers / Debt

• No blockers.
• Full Windows installer packaging was not run on this macOS host; substitute coverage includes dependency-chain proof for electron-winstaller plus build/lint/typecheck/test validation.