CI: Fix the CORS-proxy deploy by making it its own pnpm workspace root

The "Deploy CORS proxy" job has failed since the pnpm 11 move (commit ccebc3d): `wrangler: not found`, because `pnpm install` in `cors-proxy/` never populated `cors-proxy/node_modules`. That move added a repo-root `pnpm-workspace.yaml`, and pnpm 11 treats the nearest such file as the workspace root — so an install run from `cors-proxy/` walked up and installed the frontend workspace instead, leaving the proxy's own deps (including `wrangler`) uninstalled.

- Add `cors-proxy/pnpm-workspace.yaml` marking `cors-proxy/` as its own workspace root, so its `pnpm-lock.yaml` installs into `cors-proxy/node_modules`. Allow esbuild's build script (pulled in by wrangler), matching the repo-root workspace.
- Document the gotcha in `cors-proxy/CLAUDE.md`.

The live worker was unaffected (the failed deploys just didn't roll it); this restores deploys of proxy changes. Verified locally: clean `pnpm install --frozen-lockfile` now installs `wrangler 4.65.0` into `cors-proxy/node_modules` and `pnpm test` passes (14 tests).

Author: vdavid

cors-proxy/CLAUDE.md

@@ -8,6 +8,11 @@ responses; otherwise just a pass-through proxy.
 - `pnpm dev` — local dev server via wrangler
 - `pnpm deploy` — deploy to Cloudflare Workers
 
+Run these from this directory. `cors-proxy/` is a standalone pnpm project (own `package.json` + `pnpm-lock.yaml`), not
+part of the repo-root workspace. Its own `pnpm-workspace.yaml` marks it as an independent workspace root — without it,
+pnpm 11 walks up to the repo-root `pnpm-workspace.yaml` and installs the frontend workspace instead, leaving
+`cors-proxy/node_modules` (and `wrangler`) missing, which breaks `pnpm deploy` and the CI deploy job.
+
 ## Key decisions
 
 - **CORS origin**: `ALLOWED_ORIGIN` in `wrangler.toml` restricts `Access-Control-Allow-Origin` to the production

cors-proxy/pnpm-workspace.yaml

@@ -0,0 +1,10 @@
+# This directory is a standalone pnpm project (its own package.json + pnpm-lock.yaml), not part of
+# the repo-root workspace. pnpm 11 uses the nearest `pnpm-workspace.yaml` as the workspace root, so
+# without this file `pnpm install` here walks up to the repo root and installs the frontend workspace
+# instead — leaving `cors-proxy/node_modules` (and `wrangler`) missing. This file marks cors-proxy as
+# its own root so its lockfile installs here.
+
+# esbuild (pulled in by wrangler) builds a native binary in a postinstall script. A global
+# `ignore-scripts` blocks that, so allow it explicitly, matching the repo-root workspace.
+allowBuilds:
+    esbuild: true