fix(build): pin pnpm to packageManager version and allow its native builds

An unpinned 'npm i -g pnpm' drifted to pnpm 12, which hard-errors on
unapproved build scripts (ERR_PNPM_IGNORED_BUILDS) for esbuild/sharp/
unrs-resolver. Pin 10.33.0 (matching the packageManager field), approve
those three via pnpm.onlyBuiltDependencies, install with
--frozen-lockfile, and add a .dockerignore so local node_modules can
never ride into the build. Also refresh uv.lock to latest.

Dockerfile

@@ -5,11 +5,14 @@ WORKDIR /build/mta-sign-ui
 
 COPY mta-sign-ui/package.json mta-sign-ui/pnpm-lock.yaml* ./
 
-RUN npm install -g pnpm
+# Pin pnpm to the version declared in mta-sign-ui/package.json ("packageManager");
+# an unpinned global install drifts to new majors (pnpm 12 hard-errors on
+# unapproved build scripts).
+RUN npm install -g pnpm@10.33.0
 
 COPY mta-sign-ui/ ./
 
-RUN pnpm install
+RUN pnpm install --frozen-lockfile
 RUN pnpm build
 
 FROM ghcr.io/astral-sh/uv:python3.13-bookworm