fix: keep pnpm's package store out of the release builder's clean-source check

The package-release job failed its clean-tree assertion in CI. Reproduced
as root in a container with a bind-mounted checkout, as the Gitea runner
does: after checkout the tree is clean; `pnpm install --frozen-lockfile`
then creates `.pnpm-store/` (17,272 untracked files) at the checkout's
root, because pnpm keeps its store on the node_modules file system and
the checkout is its own mount; `pnpm build` changes nothing. No tracked
file is ever modified.

- `.pnpm-store/` is ignored, like node_modules: a package cache, never
  source. The clean-commit requirement is unchanged for every tracked
  file and every untracked file Git does not ignore.
- The clean-tree failure now lists `git status --short` and
  `git diff --stat`.
- Nothing is built before the clean-source assertion: the gate no longer
  runs a global `pnpm build` first. The builder asserts a clean tree,
  builds, then fails if its build changed the tree, before packing. Core's
  verifier is built after both releases, for the consumer proof only.
- Every secondary offline install (the second worktree, the consumer
  module) uses the workspace install's own store explicitly, since pnpm
  picks a store per file system and those directories are on another.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/test-standalone-module.sh

@@ -12,6 +12,7 @@
 # UI, packages with the release's own `@ekklesia/module-pack`, and verifies with Core's verifier.
 #
 # `--allow-modified` accepts a release built from a modified source tree, for local development.
+# Core must be built (`core/dist`): the module is verified with Core's own verifier.
 set -euo pipefail
 
 repository_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -37,6 +38,10 @@ while (($#)); do
 done
 [[ -n "$release" && -d "$release" ]] || fail "no release directory given"
 
+# Third-party packages come from the workspace install's own pnpm store, offline. pnpm chooses a
+# store per file system, so the module, in a temporary directory, is pointed at it explicitly.
+store="${EKKLESIA_PNPM_STORE:-$(dirname "$(cd "$repository_root" && pnpm store path)")}"
+
 work="$(mktemp -d "${TMPDIR:-/tmp}/ekklesia-standalone-XXXXXX")"
 trap 'rm -rf "$work"' EXIT
 
@@ -96,7 +101,7 @@ pinned="$(node -p 'require(process.argv[1]).devDependencies["@ekklesia/module-pa
 } >"$module/pnpm-workspace.yaml"
 
 echo "==> Installing the module from the release tarballs, offline"
-(cd "$module" && pnpm install --offline --reporter=append-only >"$work/install.log" 2>&1) ||
+(cd "$module" && pnpm install --offline --store-dir "$store" --reporter=append-only >"$work/install.log" 2>&1) ||
   {
     tail -40 "$work/install.log" >&2
     fail "install (third-party packages come from the local store: run pnpm install in the workspace first)"
@@ -125,7 +130,7 @@ EOF
 
 echo "==> Reinstalling from the lockfile alone (--frozen-lockfile)"
 rm -rf "$module/node_modules"
-(cd "$module" && pnpm install --offline --frozen-lockfile --reporter=append-only >"$work/frozen.log" 2>&1) ||
+(cd "$module" && pnpm install --offline --frozen-lockfile --store-dir "$store" --reporter=append-only >"$work/frozen.log" 2>&1) ||
   { tail -40 "$work/frozen.log" >&2; fail "frozen-lockfile install"; }
 
 echo "==> Checking what the install resolved"