chore: bump pnpm/action-setup to v6, drop dead pnpm manifest field

[tenphi]

Context

This started as "remove corepack" — but there is no corepack in this repo. No corepack enable, no corepack prepare, nothing in the workflows, docs, or scripts. CI already installs pnpm via pnpm/action-setup and pins it with packageManager: pnpm@11.0.8.

So this PR does the two cleanups that actually apply in that area, and deliberately keeps packageManager.

Changes

• pnpm/action-setup v5 → v6 in ci.yml and both jobs of release.yml. Drop-in: v5 and v6 declare identical inputs/outputs (the only action.yml delta is a description wording change). v6 is also the first version that reads devEngines.packageManager, so adopting that declaration later needs no further CI change.
• Removed pnpm.onlyBuiltDependencies from package.json. pnpm 11 no longer reads the pnpm manifest field — allowBuilds in pnpm-workspace.yaml is what governs build approval, and it already lists esbuild/sharp.

Why packageManager stays (and devEngines.packageManager does not land here)

The forward-looking devEngines.packageManager declaration isn't viable for this repo yet. Verified locally against pnpm 11.22.0 / pnpm 11.0.8 / npm 10.9.7:

• Both fields can't coexist — pnpm warns on every install: Cannot use both "packageManager" and "devEngines.packageManager" in package.json. "packageManager" will be ignored.
• packageManager is consumed here — by pnpm's own version management and by pnpm/action-setup when version is omitted. v5 does not read devEngines at all (0 occurrences in its bundled dist), so dropping the field before this bump would have broken CI.
• devEngines breaks npm-based publishing. release.yml runs npm pkg set version and npm publish --provenance. With devEngines.packageManager: {name: pnpm, …} and onFail: "download" (or "error"), every npm command exits non-zero:

  npm error code EBADDEVENGINES
  npm error EBADDEVENGINES Invalid name "pnpm" does not match "npm" for "packageManager"
  

  Only onFail: "warn"/"ignore" lets npm proceed, and warn prints that block on each npm invocation.
• pnpm 10 ignores it silently. devEngines.packageManager landed in pnpm 11.0, so a contributor on pnpm 10 would get no pin and no error — today packageManager auto-switches them.
• It pulls the pnpm binary into the lockfile. With onFail: "download", pnpm writes packageManagerDependencies plus @pnpm/exe / pnpm / @reflink entries — ~199 extra lines in pnpm-lock.yaml.

Verification

• pnpm install --frozen-lockfile under pnpm 11.0.8: clean, pnpm-lock.yaml unchanged.
• Field removal proven a no-op — node_modules/.modules.yaml is byte-identical before and after, and resolves allowBuilds: {esbuild: false, sharp: true} from pnpm-workspace.yaml with nothing sourced from the manifest field.
• pnpm hygiene (lint + format:check + typecheck) and pnpm knip pass.
• Both workflow files parse as YAML.

Follow-up worth considering (not in this PR)

pnpm/action-setup's README now names a successor: pnpm/setup@v1, recommended for pnpm 11+. It installs pnpm as a standalone native binary and can provision the runtime, replacing actions/setup-node. That's a bigger change and it would collide with release.yml's deliberate Node 24 + registry-url setup for OIDC trusted publishing, so it deserves its own PR.

---

Generated by Claude Code

[github-actions]

📦 Snapshot release

Published 0.0.0-snapshot.05f55a6.

pnpm add @tenphi/tasty@0.0.0-snapshot.05f55a6