[WOODPECKER-4303] Migrate from pnpm 10 to pnpm 11

[Viktor Yang (viktor-yang)]

What's changed

Migrates the repo from pnpm 10 to pnpm 11, following the same pattern used in Skyscanner/global-components#3412.

Changes

• package.json — packageManager → pnpm@11.0.8, engines.pnpm → >=11.0.8; added peerDependencyRules to document pre-existing peer dep mismatches (eslint 9 + react 18) that the frozen lockfile was silently bypassing; removed onlyBuiltDependencies/ignoredBuiltDependencies (migrated to pnpm-workspace.yaml)
• libs/backpack-storybook-host/package.json — synced packageManager + engines.pnpm
• .npmrc — removed the 5 settings now living in pnpm-workspace.yaml; only registry= remains
• pnpm-workspace.yaml — added migrated settings (strictPeerDependencies, engineStrict, publicHoistPattern, linkWorkspacePackages) and allowBuilds (replaces onlyBuiltDependencies/ignoredBuiltDependencies)
• pnpm-lock.yaml — regenerated with pnpm 11.0.8
• .github/workflows/*.yml (5 files) — pinned all 14 pnpm/action-setup@v4.1.0 occurrences to @fc06bc12... # v5.0.0 (v6 has a bootstrap auth bug)
• .github/dependabot.yml — added pnpm/action-setup >=6.0.0 ignore rule so Dependabot doesn't bump back to v6

Why peerDependencyRules?

The lockfile was last regenerated during the pnpm 9→10 migration. Since then, CI only ran --frozen-lockfile which skips peer dep evaluation. Regenerating the lockfile with pnpm 11 surfaces two pre-existing mismatches:

• @typescript-eslint v7 declares eslint@^8 peer dep — we're on eslint 9 (needs typescript-eslint (@typescript-eslint) v8 to fix properly, separate concern)
• bpk-react-utils / bpk-storybook-utils declare react@^17 peer dep — we're on react 18

Adding peerDependencyRules.allowedVersions is the correct pnpm way to document known acceptable mismatches without loosening strictPeerDependencies.

---

Remember to include the following changes:

• Ensure the PR title includes the name of the component you are changing so it's clear in the release notes for consumers of the changes in the version e.g [Clover-123][BpkButton] Updating the colour
• README.md (If you have created a new component) — N/A
• Component README.md — N/A
• Tests — N/A (tooling change only)
• Accessibility tests — N/A
• Storybook examples created/updated — N/A
• For breaking changes or deprecating components/properties, migration guides added — N/A (no public API change)

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[skyscanner-backpack-bot]

Visit https://backpack.github.io/storybook-prs/4657 to see this build running in a browser.