[kevindetry-milaboratories]

pack-unpublished and publish-tarballs no longer call npm. Repos that pin devEngines.packageManager to pnpm fail npm in the repo root (EBADDEVENGINES), and pnpm/setup installs Node without npm.

• Registry lookups use pnpm config get and pnpm view --json. "Not found" comes from the JSON error code: the pnpm 11+ codes, or E404 when pnpm 9/10 pass view to npm. Behavior change: pnpm 9 and 10 ignore the whole .npmrc when a ${VAR} in it is unset, and the scope mapping is lost with it. npm kept the literal text and went on, so the lookup now fails with a clear error.
• Uploads use pnpm publish <tarball>: native in pnpm 11+, with OIDC trusted publishing and provenance. Credentials come from a generated auth file through PNPM_CONFIG_NPMRC_AUTH_FILE. --tag is passed only for publishConfig.tag; pnpm defaults to latest.
• publish-tarballs installs pnpm with the shared setup-pnpm action (version, working-directory: runner.temp, no cache). The new input pnpm-version defaults to 12.14.0. The upload stops before the first package when pnpm is older than 12. The inputs node-version and npm-version are removed; no known caller passes them.
• The publish script now runs on the runner's preinstalled Node. setup-pnpm changes PATH and PNPM_HOME for the rest of the caller's job. Its pnpm/setup step is a node24 action: self-hosted runners that call publish-tarballs (the build jobs of node-matrix-pnpm and node-docker-simple-fast-pnpm) need a runner version with node24.
• The tarball check reads the manifest the way pnpm 12 does (Rust tar, last package/package.json, first gzip member, at most 2 GiB unpacked). It refuses archives where tar readers can disagree. The tar dependency is removed.
• Packed manifest checks now cover what pnpm 12 reads instead of our flags: a top-level tag must be the tag of the upload, @scope:registry is refused, and registry must match the manifest entry.
• The test workflow runs the suite again with the pnpm of publish-tarballs. In that step, REQUIRE_REAL_PNPM=1 makes a missing pnpm 12 fail the run instead of skipping the real-pnpm tests.