An unpinned 'npm i -g pnpm' drifted to pnpm 12, which hard-errors on
unapproved build scripts (ERR_PNPM_IGNORED_BUILDS) for esbuild/sharp/
unrs-resolver. Pin 10.33.0 (matching the packageManager field), approve
those three via pnpm.onlyBuiltDependencies, install with
--frozen-lockfile, and add a .dockerignore so local node_modules can
never ride into the build. Also refresh uv.lock to latest.