fix: verify pinned pnpm in Windows CI

scripts/verify-ci-isolation.mjs

@@ -5,6 +5,9 @@ const policy = JSON.parse(readFileSync("ci/runner-isolation-policy.json", "utf8"
 const workflow = readFileSync(".gitea/workflows/p0a-ci.yml", "utf8");
 
 for (const label of policy.required_labels) assert.match(workflow, new RegExp(`\\b${label}\\b`));
+assert.doesNotMatch(workflow, /\bcorepack enable\b/);
+assert.match(workflow, /Get-Content package\.json -Raw \| ConvertFrom-Json/);
+assert.match(workflow, /pnpm --version/);
 assert.match(workflow, /pnpm install --frozen-lockfile/);
 assert.match(workflow, /DADA_EXTERNAL_MODE:\s*mock/);
 assert.match(workflow, /pnpm test:all/);