feat: PNPM workspace

[bshaffer]

Description

Migrate repository to a PNPM workspace with Turborepo caching and CI test sharding.

This modernization speeds up dependency installation, reduces disk space usage, enforces strict dependency boundaries across monorepo packages, and drastically cuts CI turnaround time.

---

Key Highlights & Changes

1. PNPM Workspace & Turborepo (feat(workspace)):

   • Added pnpm-workspace.yaml and root pnpm-lock.yaml to manage packages across core/*, handwritten/*, and packages/*.
   • Configured Turborepo (turbo.json) to cache compile tasks across all packages with proper input tracking (protos/**, src/**, test/**), saving ~20 minutes on CI build steps.
   • Updated root package.json to enforce pnpm package management and set compilation concurrency.
   • Configured .npmrc with link-workspace-packages=false to mirror production registry resolution.
   • Updated root tooling (bin/linter.mjs, .mocharc.cjs, .gitignore).

2. Core Tools & Packages Compatibility (fix(core)):

   • Added standalone cross-platform proto copying (core/packages/gax/scripts/copy-protos.js) and compilation scripts in gax and tools.
   • Updated pack-n-play test fixtures and gapic-generator-typescript baselines.

3. Handwritten Package & Build Fixes (fix(handwritten)):

   • Resolved test timeouts, mock servers, and Node.js compatibility across storage, bigtable, spanner, and cloud-profiler.
   • Regenerated google-storage-control protos.

4. Kokoro & Cloud Build Modernization (ci(scripts)):

   • Updated all Kokoro (.kokoro/*.sh) and cloudbuild.yaml scripts across handwritten and core packages to use pnpm.

5. GitHub Actions CI Workflows & Matrix Sharding (ci(github)):

   • Configured 15-shard matrix unit test execution across Node 22, 24, and 26 for Linux, Windows, and Bun.
   • Pinned GitHub action hashes for security (Zizmor compliance).

---

Note: Non-critical workspace documentation and config additions have been separated into follow-up PR #9144.

[gemini-code-assist]

Code Review

This pull request migrates the repository to a pnpm workspace, updating numerous .gitignore and CONTRIBUTING.md files, adjusting CI scripts, and updating generated protobuf files. Feedback on these changes highlights several improvement opportunities: nested npm scripts in gax/package.json should be updated to pnpm, stubbed tests in pack-n-play should be explicitly skipped using it.skip rather than left empty, and relative file: paths in package dependencies should be replaced with the workspace: protocol. Additionally, the reviewer advises against using 'as any' type assertions in apirequest.ts and hapi.ts, recommending instead that workspace dependency versions be aligned or safer type casting be implemented to preserve TypeScript's type safety.

[gemini-code-assist]

Using as any here discards type safety. If the type mismatch is due to req.headers being typed as IncomingHttpHeaders (where header values can be string | string[] | undefined) and getSingleHeader expecting a specific type, it is safer to cast to the expected type (e.g., string | string[] or string) or handle the undefined case explicitly, rather than using as any.