fix: verify pinned pnpm in Windows CI

.gitea/workflows/p0a-ci.yml

@@ -15,9 +15,19 @@ jobs:
     steps:
       - name: Check out frozen revision
         uses: actions/checkout@v4
-      - name: Enable frozen package manager
+      - name: Verify frozen package manager
         shell: powershell
-        run: corepack enable
+        run: |
+          $ErrorActionPreference = "Stop"
+          $expectedPackageManager = (Get-Content package.json -Raw | ConvertFrom-Json).packageManager
+          if ($expectedPackageManager -notmatch '^pnpm@(?<version>.+)$') {
+            throw "package.json must pin pnpm with packageManager"
+          }
+          $expectedVersion = $Matches.version
+          $actualVersion = (pnpm --version).Trim()
+          if ($actualVersion -ne $expectedVersion) {
+            throw "Expected pnpm $expectedVersion, got $actualVersion"
+          }
       - name: Install frozen dependencies
         shell: powershell
         run: pnpm install --frozen-lockfile

scripts/verify-ci-isolation.mjs

@@ -5,6 +5,9 @@ const policy = JSON.parse(readFileSync("ci/runner-isolation-policy.json", "utf8"
 const workflow = readFileSync(".gitea/workflows/p0a-ci.yml", "utf8");
 
 for (const label of policy.required_labels) assert.match(workflow, new RegExp(`\\b${label}\\b`));
+assert.doesNotMatch(workflow, /\bcorepack enable\b/);
+assert.match(workflow, /Get-Content package\.json -Raw \| ConvertFrom-Json/);
+assert.match(workflow, /pnpm --version/);
 assert.match(workflow, /pnpm install --frozen-lockfile/);
 assert.match(workflow, /DADA_EXTERNAL_MODE:\s*mock/);
 assert.match(workflow, /pnpm test:all/);