chore: bump pnpm to 12.2.1

[anurag6569201]

This should fix those pesky command flag errors pnpm/pnpm#14283

Source merge-base: 03f1687fe612ce3d2d9131139b5b188d9cf90c64
Source head: 85df9dab17cd4ef84cdcb71e4f0996ad16b4c7d6

[shipwright-agent]

⚠️ Shipwright · Approve with conditions

Recommendation: approve PR #9 with conditions · Tier T3
Checks: 0 total · 0 needing attention

Next step: an authorized approver must satisfy the approval condition.

Findings (3)

• HIGH The lockfile diff updates only the packageManagerDependencies and pnpm package entries, but the diff does not show any corresponding dependency version changes. · pnpm-lock.yaml:7
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH The packageManager field is bumped from pnpm 12.0.0 to 12.2.1 while the engines.pnpm constraint remains '>=11.0.0'. · package.json:44
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH The new pnpm 12.2.1 integrity hash is introduced without any evidence of verification against a trusted source or changelog review. · package.json:44
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

Conditions

• human approval required (T3): apply the approval label

Fireworks usage: 10,631 input · 355 output · 10,986 total tokens · $0.0026 · 12s · 0 fix iteration(s)

Open the Shipwright check for full evidence and the audit bundle. Use /shipwright rerun to verify again.

[shipwright-agent]

Shipwright · HIGH

The packageManager field is bumped from pnpm 12.0.0 to 12.2.1 while the engines.pnpm constraint remains '>=11.0.0'.

Impact: The packageManager field is bumped from pnpm 12.0.0 to 12.2.1 while the engines.pnpm constraint remains '>=11.0.0'. This allows contributors running pnpm 11.x to install with a lockfile generated by pnpm 12.2.1, which can produce inconsistent dependency resolution, corrupted node_modules, or CI failures that only appear on certain machines. The engine floor should be raised to match the new packageManager version.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

[shipwright-agent]

Shipwright · HIGH

The new pnpm 12.2.1 integrity hash is introduced without any evidence of verification against a trusted source or changelog review.

Impact: The new pnpm 12.2.1 integrity hash is introduced without any evidence of verification against a trusted source or changelog review. Supply-chain policy should require checking release notes and CVE advisories for the package manager before merging a toolchain bump; the diff alone provides no such evidence.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.