Keep CI pnpm version in manifest lockstep

[ymichael]

Human comments

What was wrong

PR #3046 replaced registry-heavy pnpm bootstrapping with a direct, checksum-verified GitHub Release download, but the shared workspace setup stopped checking its requested pnpm version against the root packageManager declaration. The duplicated pins could therefore drift while CI continued testing and packaging with a different pnpm release than the project contract.

What changed

• install-pnpm.sh now reads the root packageManager through GITHUB_WORKSPACE and rejects a version mismatch before checksum lookup or download.
• The setup action documents the lockstep requirement.
• A hermetic regression proves a mismatched manifest fails before reaching the downloader.
• Turbo now includes the action files in the owning test suite's inputs.

The direct checksum-verified installer is otherwise unchanged. There are no host-daemon protocol, CLI, guide, or product behavior changes.

How you verified

• pnpm exec turbo run test typecheck --filter=@bb/scripts --force — 22 files and 130 tests passed; package typecheck passed.
• The regression failed before the production change and passes afterward, with a downloader sentinel proving rejection occurs before download.
• Matching install, missing-checksum, and corrupt-download controls passed or failed closed at their intended stages during the fixer validation.
• bash -n .github/actions/setup-workspace/install-pnpm.sh, targeted oxfmt --check, and git diff --check origin/main...HEAD — passed after rebasing onto current main.

Follow-up to #3046.

AGENT GENERATED