fix(ci): commit pnpm-lock.yaml for frozen-lockfile CI

The --frozen-lockfile flag requires the lockfile to be present
in the checkout. Previously pnpm-lock.yaml was gitignored, so
it was absent from CI checkouts.

Lockfiles SHOULD be version-controlled for reproducible builds.
This also enables CI to detect when lockfile is outdated vs
package.json.

.gitignore

@@ -30,5 +30,4 @@ docker-compose.override.yml
 *.tmp
 *.bak
 
-# pnpm
-pnpm-lock.yaml
+# pnpm (lockfile IS committed for reproducible CI builds)