chore: add pnpm packageManager field and workspace config

Add pnpm@10.33.0 as packageManager, create pnpm-workspace.yaml with
minimumReleaseAge (3 days) and onlyBuiltDependencies allowlist
(better-sqlite3, esbuild, protobufjs, sharp), update .npmrc as
safety-net fallback.

package.json

@@ -3,6 +3,7 @@
   "version": "1.2.52",
   "description": "Personal Claude assistant. Lightweight, secure, customizable.",
   "type": "module",
+  "packageManager": "pnpm@10.33.0",
   "main": "dist/index.js",
   "scripts": {
     "build": "tsc",