FN-5927: categorize pnpm build scripts for install

Document and enforce pnpm build-script review decisions to prevent ignored-script install warnings.

- add reviewed ignoredBuiltDependencies entries to the root pnpm config and mirror the effective policy in pnpm-workspace.yaml
- add a regression test that verifies reviewed dependencies are categorized exactly once and stay aligned across both config files
- document the pnpm build-script approval policy in contributing docs and link plugin authoring guidance from AGENTS.md and PLUGIN_AUTHORING.md

Files changed:
 AGENTS.md                                          |  5 ++
 docs/PLUGIN_AUTHORING.md                           |  3 +-
 docs/contributing.md                               | 14 ++++
 package.json                                       |  9 +++
 pnpm-workspace.yaml                                | 14 ++++
 scripts/__tests__/pnpm-build-scripts-config.test.mjs   | 74 ++++++++++++++++++++++
 6 files changed, 118 insertions(+), 1 deletion(-)

Fusion-Task-Id: FN-5927

Fusion-Task-Lineage: 192bbed9-c5ed-45cb-b4bd-fb18514e2783

docs/PLUGIN_AUTHORING.md

@@ -5,7 +5,6 @@ A comprehensive guide to creating Fusion plugins that extend the task board with
 ## Table of Contents
 
 1. [Getting Started](#1-getting-started)
-   - [External authoring guide](./plugins/external-authoring.md)
 2. [Plugin Manifest Reference](#2-plugin-manifest-reference)
 3. [Plugin Settings Schema](#3-plugin-settings-schema)
 4. [Available Hooks and Signatures](#4-available-hooks-and-signatures)
@@ -26,6 +25,8 @@ A comprehensive guide to creating Fusion plugins that extend the task board with
 
 ---
 
+See also: [External Plugin Authoring guide](./plugins/external-authoring.md)
+
 ## 1. Getting Started
 
 ### What Are Fusion Plugins?

docs/contributing.md

@@ -19,6 +19,20 @@ Thanks for contributing to Fusion.
 pnpm install --frozen-lockfile
 ```
 
+### pnpm build-scripts approval policy
+
+pnpm v10 blocks dependency `preinstall`/`install`/`postinstall` scripts by default and reports any uncategorized packages in the install output.
+
+When a package is flagged:
+
+- Approve it only when this repo genuinely needs that dependency's build script for supported runtime/build paths.
+- Ignore it when prebuilt artifacts, optional-native fallbacks, or release-only tooling make the script unnecessary for normal workspace verification.
+- Record every reviewed package in exactly one bucket: `onlyBuiltDependencies` or `ignoredBuiltDependencies`.
+
+Fusion currently keeps the reviewed decision set documented in the root `package.json` `pnpm` block and mirrored in `pnpm-workspace.yaml`, which is the effective pnpm v10.33 install-time config read by `pnpm install`.
+
+The guard test `node --test scripts/__tests__/pnpm-build-scripts-config.test.mjs` (also covered by `pnpm test:scripts`) enforces that the reviewed dependencies stay categorized, deduped, and non-overlapping so the ignored-build-scripts warning cannot silently return.
+
 ### Build workspace packages
 
 ```bash