build(docker): pin pnpm 9.15.9 via packageManager

The deps stage ran `corepack enable pnpm` with no version, so corepack
resolved whatever npm calls latest — pnpm 11.20.0, whose bin/pnpm.cjs is a
three-line `import('./pnpm.mjs')` shim. The corepack bundled with Node
20.11.0 loads that file through vm without an import callback and dies with
ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING. The build broke with no commit to
this repo, which is the actual defect: the version was never stated.

State it once, in the field that owns it. 9.15.9 is the last patch of the 9
line, which is what pnpm-lock.yaml (lockfileVersion 9.0) and engines.pnpm
(>=9.1.2) already ask for; pnpm 9 also still runs dependency install scripts
by default, which prisma needs. Its bin is plain CJS, so the corepack in this
base image can load it.

docker/Dockerfile

@@ -14,7 +14,10 @@ COPY prisma ./prisma
 
 ENV HUSKY 0
 
-# Install dependencies
+# Install dependencies. The pnpm version is stated once — package.json's
+# `packageManager` field — and corepack reads it from there. Unpinned, corepack
+# takes whatever npm calls latest that day; that is how this build broke with
+# no commit to the repo.
 COPY package.json pnpm-lock.yaml* ./
 RUN corepack enable pnpm && pnpm i --frozen-lockfile
 

package.json

@@ -3,6 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
+  "packageManager": "[email protected]",
   "scripts": {
     "dx": "docker compose up",
     "dx:down": "docker compose down",