[codex] pnpm化とリリース待機を7日に統一

[amyu]

概要

• npm から pnpm に移行し、pnpm-lock.yaml と packageManager を追加
• pnpm の minimumReleaseAge を 7 日に設定
• Renovate の minimumReleaseAge も全体で 7 日に統一
• CI の install / lint / dist check を pnpm に更新
• pnpm の厳密な依存解決に合わせて @actions/exec を直接依存に明示
• GitHub Action 用の dist/ を再生成

目的

サプライチェーン攻撃のリスクを下げるため、pnpm の供給網ポリシーと Renovate の更新待機時間を揃えます。

競合解消

• 最新 main に rebase
• main 側の @actions/cache@6.1.0 更新を取り込み
• package-lock.json は削除、pnpm-lock.yaml を再生成
• dist/ を pnpm で再生成

確認

• pnpm config get minimumReleaseAge --location project -> 10080
• CI=true pnpm install
• pnpm run all
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2a1c201608

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Migrate the patch-package patch before using pnpm

On a fresh CI install this switch to pnpm still leaves postinstall: patch-package and patches/@actions+cache+6.1.0.patch in place, but patch-package v8 only auto-applies patches for npm/yarn lockfiles and recommends pnpm's native patch support instead. Since this commit deletes package-lock.json, pnpm install will run the postinstall with no supported lockfile, causing the new lint/check-dist installs to fail before any build steps (or leaving the @actions/cache patch unapplied if bypassed). Please migrate the existing patch to pnpm patchedDependencies before removing the npm lockfile.

Useful? React with 👍 / 👎.