fix: keep pnpm's package store out of the release builder's clean-source check

The package-release job failed its clean-tree assertion in CI. Reproduced
as root in a container with a bind-mounted checkout, as the Gitea runner
does: after checkout the tree is clean; `pnpm install --frozen-lockfile`
then creates `.pnpm-store/` (17,272 untracked files) at the checkout's
root, because pnpm keeps its store on the node_modules file system and
the checkout is its own mount; `pnpm build` changes nothing. No tracked
file is ever modified.

- `.pnpm-store/` is ignored, like node_modules: a package cache, never
  source. The clean-commit requirement is unchanged for every tracked
  file and every untracked file Git does not ignore.
- The clean-tree failure now lists `git status --short` and
  `git diff --stat`.
- Nothing is built before the clean-source assertion: the gate no longer
  runs a global `pnpm build` first. The builder asserts a clean tree,
  builds, then fails if its build changed the tree, before packing. Core's
  verifier is built after both releases, for the consumer proof only.
- Every secondary offline install (the second worktree, the consumer
  module) uses the workspace install's own store explicitly, since pnpm
  picks a store per file system and those directories are on another.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/public-packages.test.ts

@@ -1,3 +1,4 @@
+import { spawnSync } from "node:child_process";
 import { readdir, readFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -361,6 +362,17 @@ describe("the pack hook", () => {
   });
 });
 
+describe("a clean source tree", () => {
+  it("ignores pnpm's package store, which pnpm creates in a checkout that is its own mount", () => {
+    // In CI the checkout is a workspace volume, so `pnpm install` puts `.pnpm-store/` at its root:
+    // a package cache, never source, which must not make the release builder's clean tree dirty.
+    const ignored = spawnSync("git", ["check-ignore", "--quiet", ".pnpm-store/v11/index.db"], {
+      cwd: repositoryRoot,
+    });
+    expect(ignored.status).toBe(0);
+  });
+});
+
 describe("the release directory", () => {
   const version = "0.1.2";
   function release(mutate?: (files: Map<string, Uint8Array>) => void) {