chore: bump pnpm to v11

[mvvmm]

Summary

Upgrades pnpm from v10 to v11 across CI workflows and repo config.

Changes:

• All 5 GitHub Actions workflows updated to version: 11
• pnpm-workspace.yaml: replaced removed onlyBuiltDependencies setting with the new allowBuilds map; added saveExact and saveDev settings (moved from .npmrc)
• .npmrc deleted — pnpm 11 restricts .npmrc to auth/registry settings only; non-auth config now lives in pnpm-workspace.yaml
• Explicitly denied build scripts for transitive deps (@google/genai, @mongodb-js/zstd, core-js-pure, node-liblzma, protobufjs) that don't need native binaries in this repo

[github-actions]

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern	Owners
/.github/	@cloudflare/content-engineering, @kodster28, @mvvmm, @colbywhite, @ahaywood, @MohamedH1998
*	@cloudflare/product-owners

[ask-bonk]

Clean, complete infrastructure upgrade. No issues found.

Summary: This PR consistently upgrades pnpm from v10 to v11 across all CI workflows and migrates configuration from .npmrc to pnpm-workspace.yaml as required by pnpm 11. The allowBuilds map correctly replaces the removed onlyBuiltDependencies list, and the transitive dependency build denials are appropriately scoped.

Verified:

• All 5 workflows updated to version: 11
• No remaining references to pnpm v10 in CI configuration
• saveExact / saveDev correctly moved from .npmrc to pnpm-workspace.yaml
• allowBuilds syntax matches pnpm v11 specification

[ask-bonk]

Applied the engineering label and reviewed PR #30937.

Verdict: Clean, complete infrastructure upgrade. No issues found.

What I checked:

• All 5 GitHub Actions workflows were consistently updated to version: 11
• pnpm-workspace.yaml correctly replaces the removed onlyBuiltDependencies list with the pnpm v11 allowBuilds map
• saveExact and saveDev were properly migrated from .npmrc to pnpm-workspace.yaml
• No remaining pnpm v10 references in CI configuration
• The transitive dependency build denials (@google/genai, @mongodb-js/zstd, core-js-pure, node-liblzma, protobufjs) are appropriately scoped

Labels applied: engineering

github run

[github-actions]

Preview URL: https://4857799f.preview.developers.cloudflare.com
Preview Branch URL: https://bump-pnpm-11.preview.developers.cloudflare.com