- Remove package-lock.json, add pnpm-lock.yaml for frozen installs - Add pnpm-workspace.yaml with onlyBuiltDependencies (better-sqlite3) and minimumReleaseAge matching root project policy - Dockerfile: allow agent-browser build scripts via global .npmrc (global installs don't read project-level workspace config) - Dockerfile: make lockfile and workspace COPY mandatory (drop glob)