chore(build): migrate from yarn v1 to pnpm

[serhalp]

Summary

This migrates the Gatsby monorepo's own tooling from yarn v1 to pnpm 10.

The scope is intentionally narrow:

• repo tooling only
• no user-facing package manager behavior changes
• no package manager support test changes
• no examples, starters, demos, or fixture migrations

Lerna stays in place as the orchestration/release layer, but it now runs on top of pnpm instead of yarn.

What changed

• added pnpm root/workspace config
• removed root yarn 1 plumbing
• configured Lerna to use pnpm
• converted workspace-local dependencies to workspace: ranges so pnpm links local packages correctly
• updated all run commands and such from yarn to pnpm
• moved workspace build hooks from prepare to prepack (see blow)
• updated bootstrap to run lerna run prepack explicitly
• added pnpm 10 build approvals for required dependency install scripts (see below)

Why the prepare change matters

This repo had been using package prepare as a monorepo build hook.

That was mostly tolerated by yarn v1, but under pnpm it makes a normal install behave badly by trying to build large parts of the workspace during pnpm install. This sort of happened to work because of how work was delegated across yarn and lerna.

This PR fixes that by moving those workspace build hooks to prepack, which gives us cleaner semantics:

• pnpm install installs dependencies and runs approved dependency build scripts
• pnpm bootstrap is the explicit install + workspace build entrypoint

That keeps normal developer workflow unsurprising while preserving the repo's build/release behaviour.

pnpm 10 build approvals

pnpm 10 blocks dependency postinstall scripts unless they are explicitly approved.

This PR opts into explicit approvals for the packages this repo already relies on during install.

Validation

Ran successfully:

• pnpm install --force --no-frozen-lockfile
• pnpm ignored-builds
• node scripts/check-versions.js
• pnpm check-repo-fields
• sh scripts/check-lockfile.sh
• pnpm bootstrap --skip-install --concurrency=2

Notes

• The special release-next-major publish path still passes --ignore-scripts; that is unchanged from the normal day-to-day contributor workflow and is separate from the install/bootstrap migration.
• No files under examples/, starters/, e2e-tests/, or integration-tests/ were modified by this change.