chore: migrate build-script approvals to pnpm-workspace allowBuilds

pnpm 11 no longer reads the package.json "pnpm" field, so
onlyBuiltDependencies there was silently ignored. Move the approvals to
allowBuilds in pnpm-workspace.yaml, carrying electron over so its
binary-download postinstall isn't skipped on fresh installs, alongside
the newly approved electron-winstaller.

Also drop the overrides entry a stray `pnpm link` wrote (it rewrote the
example's workspace:* resolution to link:..) and regenerate the
lockfile, which picks up pnpm 11's libc metadata.

Author: nicknisi

package.json

@@ -86,11 +86,5 @@
   },
   "engines": {
     "node": ">=20.0.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "electron",
-      "esbuild"
-    ]
   }
 }

pnpm-lock.yaml

@@ -1,3 +1,7 @@
 packages:
   - '.'
   - example/
+allowBuilds:
+  electron: true
+  electron-winstaller: true
+  esbuild: true