build: move to pnpm

One package manager, one lockfile. pnpm-lock.yaml is tracked, package-lock.json is
deleted and every other manager's is ignored, and `packageManager` pins the version
corepack installs. pnpm-workspace.yaml names the packages allowed to run install
scripts; pnpm denies the rest by default.

Co-authored-by: Hanzo Dev <[email protected]>

.gitignore

@@ -52,3 +52,8 @@ CLAUDE.md
 GEMINI.md
 GROK.md
 QWEN.md
+
+# pnpm only — pnpm-lock.yaml is the tracked lockfile.
+package-lock.json
+yarn.lock
+bun.lockb

package.json

@@ -1,6 +1,7 @@
 {
   "name": "@hanzo/brand",
   "version": "1.4.4",
+  "packageManager": "[email protected]",
   "description": "Official brand assets and design system for Hanzo AI",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -55,7 +56,7 @@
     "dev": "tsup src/index.ts src/loader.ts src/hero.ts src/cli.ts src/brand-id.ts src/registry.ts src/marks.ts --format cjs,esm --dts --watch",
     "lint": "eslint src",
     "type-check": "tsc --noEmit",
-    "test": "npm run build && node --test test/*.test.mjs"
+    "test": "pnpm build && node --test test/*.test.mjs"
   },
   "keywords": [
     "hanzo",

pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+# Install scripts run only for packages listed here.
+allowBuilds:
+  esbuild: true
+
+# Our own scopes skip pnpm's new-release quarantine. Scope glob, not a version
+# pin: pnpm rewrites version entries on every bump and breaks --frozen-lockfile.
+minimumReleaseAgeExclude:
+  - '@hanzo/*'
+  - '@hanzogui/*'