FN-5927: categorize pnpm build scripts for install

Document and enforce pnpm build-script review decisions to prevent ignored-script install warnings.

- add reviewed ignoredBuiltDependencies entries to the root pnpm config and mirror the effective policy in pnpm-workspace.yaml
- add a regression test that verifies reviewed dependencies are categorized exactly once and stay aligned across both config files
- document the pnpm build-script approval policy in contributing docs and link plugin authoring guidance from AGENTS.md and PLUGIN_AUTHORING.md

Files changed:
 AGENTS.md                                          |  5 ++
 docs/PLUGIN_AUTHORING.md                           |  3 +-
 docs/contributing.md                               | 14 ++++
 package.json                                       |  9 +++
 pnpm-workspace.yaml                                | 14 ++++
 scripts/__tests__/pnpm-build-scripts-config.test.mjs   | 74 ++++++++++++++++++++++
 6 files changed, 118 insertions(+), 1 deletion(-)

Fusion-Task-Id: FN-5927

Fusion-Task-Lineage: 192bbed9-c5ed-45cb-b4bd-fb18514e2783

scripts/__tests__/pnpm-build-scripts-config.test.mjs

@@ -0,0 +1,74 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse as parseYaml } from "yaml";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const repoRoot = path.resolve(__dirname, "../..");
+
+const decidedDeps = [
+  "@google/genai",
+  "better-sqlite3",
+  "cpu-features",
+  "electron-winstaller",
+  "keytar",
+  "sharp",
+  "ssh2",
+];
+
+function readPackagePnpmConfig() {
+  const packageJson = JSON.parse(readFileSync(path.join(repoRoot, "package.json"), "utf8"));
+  return packageJson.pnpm ?? {};
+}
+
+function readWorkspaceConfig() {
+  return parseYaml(readFileSync(path.join(repoRoot, "pnpm-workspace.yaml"), "utf8")) ?? {};
+}
+
+function assertUniqueArray(values, label) {
+  assert.ok(Array.isArray(values), `${label} must be an array`);
+  const duplicates = values.filter((value, index) => values.indexOf(value) !== index);
+  assert.deepEqual(duplicates, [], `${label} must not contain duplicates`);
+}
+
+function assertDisjoint(left, right, label) {
+  const overlap = left.filter((value) => right.includes(value));
+  assert.deepEqual(overlap, [], `${label} must be disjoint`);
+}
+
+function assertDecisionCoverage(config, label) {
+  const ignored = config.ignoredBuiltDependencies ?? [];
+  const approved = config.onlyBuiltDependencies ?? [];
+
+  assertUniqueArray(ignored, `${label}.ignoredBuiltDependencies`);
+  assertUniqueArray(approved, `${label}.onlyBuiltDependencies`);
+  assertDisjoint(ignored, approved, `${label} build-script arrays`);
+
+  for (const dep of decidedDeps) {
+    const membershipCount = Number(ignored.includes(dep)) + Number(approved.includes(dep));
+    assert.equal(
+      membershipCount,
+      1,
+      `${label} must categorize ${dep} in exactly one build-script array`,
+    );
+  }
+}
+
+test("package.json records the reviewed ignored-build decisions", () => {
+  assertDecisionCoverage(readPackagePnpmConfig(), "package.json#pnpm");
+});
+
+test("pnpm-workspace.yaml keeps the effective install-time build-script policy aligned", () => {
+  const workspaceConfig = readWorkspaceConfig();
+  assertDecisionCoverage(workspaceConfig, "pnpm-workspace.yaml");
+
+  const packageConfig = readPackagePnpmConfig();
+  assert.deepEqual(
+    workspaceConfig.ignoredBuiltDependencies,
+    packageConfig.ignoredBuiltDependencies,
+    "workspace ignoredBuiltDependencies should match the documented package.json decisions",
+  );
+});