deps: upgrade pnpm from 11 to 12.9.1 - #28

deps: upgrade pnpm from 11 to 12.9.1

What improved

• package.json packageManager: pnpm@11.3.0 → pnpm@12.9.1 (current latest, per npm view pnpm dist-tags).
• pnpm/action-setup: @v4 → @v6.1.0 in ci.yml, pages.yml, publish.yml.
• publish.yml: removed with: version: 11, so the version now comes from packageManager, the same way ci.yml and pages.yml already work.
• pnpm-lock.yaml: pnpm 12 added its env-lockfile document at the top (packageManagerDependencies: pnpm 12.9.1 plus the @pnpm/exe.* integrity hashes). The project dependency section did not change, and a second pnpm install made no further changes ("Already up to date").

Why

• The publish workflow was already broken. In pnpm/action-setup@v4, readTarget() (src/install-pnpm/run.ts) throws Multiple versions of pnpm specified whenever the version input is not equal to the packageManager version. "11" is not equal to "11.3.0", so any v* tag push would have failed at the setup step. Taking version: out of the workflow fixes this and leaves package.json as the only place the version is set.
• The action bump is required for pnpm 12. pnpm 12 ships as a native executable: the bin.pnpm entry is an ELF binary, filled in by install.js from @pnpm/exe.<platform>. The v4 action runs the bin through Node. Locally, pnpm 11.3.0 hit the same issue when it tried to switch to 12.9.1 (SyntaxError: Invalid or unexpected token on the ELF header). Support was added in action-setup v6.1.0 ("feat: support pnpm v12", feat: support pnpm v12 pnpm/action-setup#288). v5.0.0 only moved the action to Node 24, and v6.0.0 only added pnpm 11 support, so neither has breaking changes for these workflows.
• The action is pinned to @v6.1.0, not the floating @v6. git ls-remote shows v6^{} = 0977fd9, which is one commit behind v6.1.0^{} = ea17c68 (the pnpm 12 support commit). So @v6 would not yet install pnpm 12.

pnpm 12 breaking changes checked against this repo (v12.0.0 release notes)

• Unknown pnpm-workspace.yaml settings now cause an error. pnpm-workspace.yaml only uses packages and allowBuilds. Install under 12.9.1 printed no unrecognized-setting warning or error.
• --frozen-lockfile false was removed. No workflow or script uses it.
• Git-host dependency resolution, engineStrict on optional subtrees, and canonical cycle breaking: none of these affect this repo. There are no git dependencies, and the lockfile resolved unchanged.

Verification (local, Node v24.21.0, pnpm 12.9.1 installed with npm i -g --prefix /tmp/pnpm12 pnpm@12.9.1)

• pnpm install --frozen-lockfile: "Lockfile is up to date, resolution step is skipped". 187 packages, Done … using pnpm v12.9.1.
• pnpm check:all (the CI job: windy-lib build, wasm build, tsc, svelte-check, eslint, tests, prettier check, clippy/fmt/cargo test, webapp build): passed all the way to the final vite build (✓ built).
• Publish job steps: pnpm build exited 0. pnpm test gave 59 pass, 0 fail. pnpm publish --dry-run --no-git-checks --access public ran prepublishOnly (tsc) and printed "Skip publishing winga-weather-routing@0.1.0 (dry run)".
• All three workflow files parse as YAML.
• Not exercised: the GitHub Actions runs themselves (ci/pages/publish on a real runner). These are the first runs that will use pnpm/action-setup@v6.1.0.

Deliberately not changed

• The other actions are still on their current majors: actions/checkout@v4, actions/setup-node@v4, jetli/wasm-pack-action@v0.4.0, actions/configure-pages@v5, actions/upload-pages-artifact@v3, actions/deploy-pages@v4. They are outside this finding.
• pnpm/action-setup is pinned to the exact v6.1.0 tag. Once upstream moves the floating v6 tag to include ea17c68 (or later), it can go back to @v6 to pick up patch releases.
• Developer machines on the system pnpm 11.x cannot auto-switch to 12.9.1 through packageManager: pnpm 11.3.0 fails trying to run the native binary as JS. They need to install pnpm 12 directly (for example npm i -g pnpm@12). DEVELOPMENT.md only says "pnpm" under prerequisites and was left unchanged.
• The MODULE_TYPELESS_PACKAGE_JSON warning for webapp/svelte.config.js and the >500 kB chunk warning during vite build existed before this change and are unrelated to pnpm.