chore: reconcile dependency updates with workspace constraints

[peter-gy]

Reconcile #83 and #75 against the current dependency graph and the repository's release-age policy. Both bot PRs currently fail during frozen installation, before their substantive checks run.

• Update Knip from 6.37.0 to the mature 6.38.0 release and regenerate pnpm-lock.yaml with the declared pnpm version, preserving pnpmfileChecksum and package-manager records.
• Keep @babel/parser on 7.29.9 and constrain Renovate to <8: the installed Vue 3.5.43 compiler packages declare ^7.29.8. Forcing parser 8 through a global override is outside their supported dependency range. Revisit this constraint when the Vue compilers support Babel 8.
• Add npm PR guidance and a contributor workflow for repairing lockfiles generated without the workspace packing hook, checking frozen installation, and respecting the cooldown.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cubic-dev-ai]

No issues found across 4 files

_{Re-trigger cubic}