FN-5927: categorize pnpm build scripts for install

Document and enforce pnpm build-script review decisions to prevent ignored-script install warnings.

- add reviewed ignoredBuiltDependencies entries to the root pnpm config and mirror the effective policy in pnpm-workspace.yaml
- add a regression test that verifies reviewed dependencies are categorized exactly once and stay aligned across both config files
- document the pnpm build-script approval policy in contributing docs and link plugin authoring guidance from AGENTS.md and PLUGIN_AUTHORING.md

Files changed:
 AGENTS.md                                          |  5 ++
 docs/PLUGIN_AUTHORING.md                           |  3 +-
 docs/contributing.md                               | 14 ++++
 package.json                                       |  9 +++
 pnpm-workspace.yaml                                | 14 ++++
 scripts/__tests__/pnpm-build-scripts-config.test.mjs   | 74 ++++++++++++++++++++++
 6 files changed, 118 insertions(+), 1 deletion(-)

Fusion-Task-Id: FN-5927

Fusion-Task-Lineage: 192bbed9-c5ed-45cb-b4bd-fb18514e2783

package.json

@@ -60,6 +60,15 @@
     "dist:desktop:win": "pnpm --filter @fusion/desktop build && pnpm --filter @fusion/desktop dist:win"
   },
   "pnpm": {
+    "ignoredBuiltDependencies": [
+      "@google/genai",
+      "better-sqlite3",
+      "cpu-features",
+      "electron-winstaller",
+      "keytar",
+      "sharp",
+      "ssh2"
+    ],
     "onlyBuiltDependencies": [
       "@homebridge/node-pty-prebuilt-multiarch",
       "electron",