fix(docker): copy pnpm-workspace.yaml and bump corepack pnpm to 11.5.2

pnpm 11's minimumReleaseAgeExclude/allowBuilds/publicHoistPattern now live
in pnpm-workspace.yaml, which the Dockerfile wasn't copying — so the in-image
pnpm install rejected @types/node@22.19.20 under the 1-day supply-chain gate.
Also align the corepack prepare pin (was 10.29.3) with packageManager (11.5.2).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jordanburke

Dockerfile

@@ -2,13 +2,13 @@
 FROM node:22-alpine AS builder
 
 # Install pnpm
-RUN corepack enable && corepack prepare pnpm@10.29.3 --activate
+RUN corepack enable && corepack prepare pnpm@11.5.2 --activate
 
 # Set working directory
 WORKDIR /app
 
 # Copy package files
-COPY package.json pnpm-lock.yaml ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 
 # Install dependencies
 RUN pnpm install --frozen-lockfile
@@ -24,7 +24,7 @@ RUN pnpm build
 FROM node:22-alpine
 
 # Install pnpm
-RUN corepack enable && corepack prepare pnpm@10.29.3 --activate
+RUN corepack enable && corepack prepare pnpm@11.5.2 --activate
 
 # Create non-root user
 RUN addgroup -g 1001 -S nodejs && \
@@ -34,7 +34,7 @@ RUN addgroup -g 1001 -S nodejs && \
 WORKDIR /app
 
 # Copy package files
-COPY package.json pnpm-lock.yaml ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 
 # Install production dependencies only
 RUN pnpm install --frozen-lockfile --prod