perf(build): dedup npm-pack bundle via pnpm overrides

Add pnpm overrides to dedup duplicate packages in the npm-pack
external bundle:
- pacote 21.0.1 → 21.5.0 (matches @npmcli/arborist's ^21.0.2 range)
- make-fetch-happen 15.0.2 → 15.0.5
- 7 transitive packages deduped to latest majors:
  npm-bundled 5.0.0, npm-normalize-package-bin 5.0.0,
  json-parse-even-better-errors 5.0.0,
  @npmcli/installed-package-contents 4.0.0,
  @npmcli/name-from-folder 4.0.0, @npmcli/promise-spawn 9.0.1,
  @npmcli/redact 4.0.0

npm-pack.js: 69,738 → 66,443 lines (2.59MB → 2.46MB).
22 duplicate packages removed from node_modules.

Also add packageOpts.plugins passthrough in the external bundler's
esbuild config for package-specific plugins.

Author: jdalton