[lukemelia]

Summary

Same switch as ember-cli-deploy/ember-cli-deploy-s3#211 and ember-cli-deploy/ember-cli-deploy-s3-index#151.

• Lockfile: yarn.lock → pnpm-lock.yaml, generated with pnpm import so every resolved version carries over unchanged (including Bump minimatch from 3.1.2 to 10.2.6 #103, Upgrade simple-git to v4 (ambient GIT_* env vars are no longer passed to git) #104 and Bump handlebars from 4.0.6 to 4.7.10 #107).
• Transitive bumps: a second commit applies Dependabot's Bump proxy-addr from 2.0.7 to 2.0.8 #109–Bump morgan from 1.10.0 to 1.12.1 #112 (morgan 1.12.1, compression 1.8.2, proxy-addr 2.0.8, brace-expansion 1.1.21) with pnpm update, so those don't have to land on yarn.lock first. Dependabot will close them once yarn.lock is gone.
• packageManager: pin pnpm@12.15.0 (with checksum). Volta keeps the Node pin and drops the yarn pin.
• pnpm-workspace.yaml: allowBuilds: { core-js: false }. pnpm 12 fails the install on unapproved build scripts; core-js 2's postinstall only prints a funding banner.
• CI: add pnpm/action-setup@v6 and cache: 'pnpm'; pnpm install --frozen-lockfile for Test, pnpm install --no-lockfile for Floating Dependencies. Also run on push as well as pull_request, matching the s3 and s3-index workflows. Until now, master never got its own CI run, and PRs stacked on other branches got none.
• Docs: README and RELEASE.md use pnpm test / pnpm install.

No change to the published package.

Testing

On Node 20.19.0, locally:

• pnpm install --frozen-lockfile + pnpm test: 33 passing, ESLint clean
• pnpm install --no-lockfile + pnpm test: 33 passing

🤖 Generated with Claude Code

https://claude.ai/code/session_01Rvn9nzW2qDp8TtbmZ4mEve