chore(lockfile): refresh pnpm-lock.yaml (#12771)

Use full dependency resolution in automated lockfile repair paths, add regression coverage, and refresh the stale Rollup snapshot.

Co-Authored-By: Dotta <cryppadotta@users.noreply.github.com>
Co-Authored-By: Codex <codex@openai.com>
Co-Authored-By: lockfile-bot <lockfile-bot@users.noreply.github.com>

.github/scripts/tests/lockfile-refresh-workflows.test.mjs

@@ -0,0 +1,24 @@
+import { readFile } from 'node:fs/promises';
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+const workflows = [
+  '.github/workflows/refresh-lockfile.yml',
+  '.github/workflows/pr-trusted.yml',
+  '.github/workflows/docker.yml',
+];
+
+test('lockfile repair workflows resolve dependencies instead of updating metadata only', async () => {
+  for (const workflow of workflows) {
+    const contents = await readFile(workflow, 'utf8');
+    const repairCommands = contents
+      .split('\n')
+      .filter((line) => line.includes('pnpm install') && line.includes('--no-frozen-lockfile'));
+
+    assert.ok(repairCommands.length > 0, `${workflow} must contain a lockfile repair command`);
+    for (const command of repairCommands) {
+      assert.match(command, /--ignore-scripts/);
+      assert.doesNotMatch(command, /--lockfile-only/);
+    }
+  }
+});

.github/workflows/docker.yml

@@ -87,7 +87,7 @@ jobs:
       - name: Refresh lockfile for Docker build context
         run: |
           set -euo pipefail
-          pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --no-frozen-lockfile
 
           changed="$(git status --porcelain)"
           if [ -z "$changed" ]; then
@@ -281,7 +281,7 @@ jobs:
       - name: Refresh lockfile for Docker build context
         run: |
           set -euo pipefail
-          pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --no-frozen-lockfile
 
           changed="$(git status --porcelain)"
           if [ -z "$changed" ]; then

.github/workflows/pr-trusted.yml

@@ -337,7 +337,7 @@ jobs:
         id: regen_lockfile
         run: |
           cp pnpm-lock.yaml "$RUNNER_TEMP/pnpm-lock.before.yaml"
-          pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --no-frozen-lockfile
           if cmp -s "$RUNNER_TEMP/pnpm-lock.before.yaml" pnpm-lock.yaml; then
             echo "regenerated=0" >> "$GITHUB_OUTPUT"
           else

.github/workflows/refresh-lockfile.yml

@@ -35,7 +35,7 @@ jobs:
           cache: pnpm
 
       - name: Refresh pnpm lockfile
-        run: pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+        run: pnpm install --ignore-scripts --no-frozen-lockfile
 
       - name: Fail on unexpected file changes
         run: |

pnpm-lock.yaml

@@ -7210,7 +7210,6 @@ packages:
 
   opencode-ai@1.18.17:
     resolution: {integrity: sha512-Pc2D3Y6iQ3BAjcKw9E+9J7VTWNazIwFknFfrolufMCrJ0FLxOIZfndoHmJrx4x1oqpK2CPAqK9D2V6nsp6Oebw==}
-    cpu: [arm64, x64]
     os: [darwin, linux, win32]
     hasBin: true
 
@@ -16024,7 +16023,7 @@ snapshots:
       fdir: 6.5.0(picomatch@4.0.7)
       picomatch: 4.0.7
       postcss: 8.5.26
-      rollup: 4.62.4
+      rollup: 4.63.1
       tinyglobby: 0.2.17
     optionalDependencies:
       '@types/node': 24.13.3

scripts/__tests__/e2e-shard.test.mjs

@@ -306,8 +306,8 @@ test("the trusted PR workflow regenerates stale stacked lockfiles", () => {
   );
   assert.match(
     workflow,
-    /pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile/,
-    "the policy job must validate the complete merge tree instead of only the current PR layer",
+    /pnpm install --ignore-scripts --no-frozen-lockfile/,
+    "the policy job must resolve the complete merge tree instead of only updating lockfile metadata",
   );
   assert.match(
     workflow,