build: move the worker from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. allowBuilds and
pnpm.onlyBuiltDependencies collapse into package.json#allowScripts, which npm
11 gates the same way; sharp is omitted because it is not in the tree.

cloudflare-worker/.github/workflows/ci.yml is updated for consistency even
though it never runs: GitHub only reads workflows from the repository root.

cloudflare-worker/.github/workflows/ci.yml

@@ -10,13 +10,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v7
         with:
           node-version: '24'
-          cache: 'pnpm'
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm test
-      - run: pnpm exec wrangler deploy --dry-run
+          cache: 'npm'
+      - run: npm ci
+      - run: npm test
+      - run: npx wrangler deploy --dry-run
         env:
           CLOUDFLARE_API_TOKEN: dummy