Upgrade pnpm to 11.25.0

[Finesssee]

Summary

• upgrade the pinned package manager from pnpm 11.24.0 to pnpm 11.25.0
• keep the release prerequisite pin, focused test, repo guidance, and CI documentation aligned
• leave pnpm-lock.yaml unchanged because the lockfile format/content is compatible and frozen install is stable

Validation

• pnpm --version -> 11.25.0
• pnpm install --frozen-lockfile -> pass; pnpm-lock.yaml SHA-256 unchanged
• scripts/release-pipeline.tests.ps1 -> pass
• .github/scripts/interaction-guard.test.mjs -> 9/9 pass
• frontend Vitest -> 48/48 files, 295/295 tests pass
• frontend production build -> pass
• install-release-prerequisites.ps1 -AssertOnly accepts Node 24 and pnpm 11.25.0, then stops later because this workstation does not have Inno Setup 6
• prior hosted Windows A/B evidence in [experiment] Benchmark pnpm vs Bun on CircleCI #428 ran pnpm 11.25.0 successfully in all three real CircleCI runs

Local CI mirror limitation

local-check.ps1 -Slice ci reaches Rust clippy but cannot complete on this workstation because link.exe resolves to C:\Program Files\Git\usr\bin\link.exe rather than the MSVC linker. No Rust code changed in this PR.

No UI changes, so CUA proof is not applicable.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 59f45040-2591-4e7e-b2f5-3eab59c9d889

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Finesssee]

Thermo-nuclear review: APPROVE WITH PROCESS NOTE

The diff is appropriately boring: one package-manager pin is updated consistently across packageManager, release prerequisite enforcement/tests, AGENTS guidance, and CI docs. The lockfile is intentionally unchanged and the PR supplies frozen-install evidence. No structural expansion, no 1,000-line issue, no UI/CUA requirement.

Process note: this PR still targets port/upstream-0.56.0, while the active rebuilt review train uses review/upstream-0.56.0 and later stacked review branches. If this upgrade is meant to land with the current train, retarget/rebase it onto the branch that will actually be merged so the pin is not stranded on the superseded integration line.

[Finesssee]

Thermo-nuclear code quality review: CHANGES

P1: the current PR diff is structurally contaminated by fourteen unrelated porting commits

The PR is titled as a pnpm upgrade, but its current main-base diff is 35 files and about 2.3k additions. Before the pnpm commit, the branch carries fourteen upstream-port/review commits touching Antigravity history/quota, Cursor token costs, Codex API/reset handling, Grok, OpenRouter, localization, and other provider code. Examples include a new 570-line rust/src/providers/antigravity/local_sqlite.rs and a 419-line rewrite in rust/src/providers/cursor/token_cost.rs.

This cannot be reviewed or merged as an atomic package-manager change. Do not rearrange this history in place. Use the clean replacement branch/PR that contains only the intended approved tips, then close this contaminated PR. The existing clean replacement is #457.

[Finesssee]

Superseded by #457, which carries the intended pnpm/toolchain change on clean history, includes the thermo review fixes, and is now merged. Closing this original instead of resolving/importing its unrelated porting commits.