chore(ci): create sfw-free shims for all supported package managers

Move the pnpm shim from inline workflow blocks into the shared install
action. Create shims for all sfw-free supported package managers
(npm, yarn, pnpm, pip, uv, cargo) using resolved absolute paths to
avoid recursive lookup. Shims are added to GITHUB_PATH so they persist
across all job steps. Includes Windows .cmd shim support.

Author: jdalton

.github/actions/install/action.yml

@@ -40,6 +40,25 @@ runs:
         fi
         echo "SFW_BIN=$SFW_BIN" >> "${GITHUB_ENV:-/dev/null}"
 
+    - name: Create sfw shims
+      shell: bash
+      run: | # zizmor: ignore[github-env]
+        SHIM_DIR="${RUNNER_TEMP:-/tmp}/sfw-shim"
+        mkdir -p "$SHIM_DIR"
+        IS_WINDOWS=false
+        [[ "$OSTYPE" == msys* || "$OSTYPE" == cygwin* ]] && IS_WINDOWS=true
+        for CMD in npm yarn pnpm pip uv cargo; do
+          REAL="$(which "$CMD" 2>/dev/null || true)"
+          [ -z "$REAL" ] && continue
+          printf '#!/bin/bash\nexec "%s" "%s" "$@"\n' "$SFW_BIN" "$REAL" > "$SHIM_DIR/$CMD"
+          chmod +x "$SHIM_DIR/$CMD"
+          if $IS_WINDOWS; then
+            printf '@echo off\r\n"%s" "%s" %%*\r\n' "$SFW_BIN" "$REAL" > "$SHIM_DIR/$CMD.cmd"
+          fi
+        done
+        echo "$SHIM_DIR" >> "${GITHUB_PATH:-/dev/null}"
+        echo "SFW_SHIM_DIR=$SHIM_DIR" >> "${GITHUB_ENV:-/dev/null}"
+
     - name: Install dependencies
       shell: bash
       working-directory: ${{ inputs.working-directory }}

.github/workflows/_local-not-for-reuse-ci.yml

@@ -48,11 +48,9 @@ jobs:
       - name: Build registry
         shell: bash
         run: |
-          alias pnpm="$SFW_BIN pnpm"
           pnpm run build
 
       - name: Run npm package tests
         shell: bash
         run: |
-          alias pnpm="$SFW_BIN pnpm"
           node scripts/npm/test-npm-packages.mjs

.github/workflows/_local-not-for-reuse-weekly-update.yml

@@ -30,7 +30,6 @@ jobs:
         id: check
         shell: bash
         run: |
-          alias pnpm="$SFW_BIN pnpm"
           echo "Checking for npm package updates..."
           HAS_UPDATES=false
           NPM_UPDATES=$(pnpm outdated 2>/dev/null || true)
@@ -74,13 +73,6 @@ jobs:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           GITHUB_ACTIONS: 'true'
         run: |
-          if [ -n "$SFW_BIN" ]; then
-            mkdir -p /tmp/sfw-bin
-            printf '#!/bin/bash\nexec "%s" pnpm "$@"\n' "$SFW_BIN" > /tmp/sfw-bin/pnpm
-            chmod +x /tmp/sfw-bin/pnpm
-            export PATH="/tmp/sfw-bin:$PATH"
-          fi
-
           if [ -z "$ANTHROPIC_API_KEY" ]; then
             echo "ANTHROPIC_API_KEY not set - skipping automated update"
             echo "success=false" >> $GITHUB_OUTPUT
@@ -107,13 +99,6 @@ jobs:
         id: tests
         if: steps.update.outputs.success == 'true'
         run: |
-          if [ -n "$SFW_BIN" ]; then
-            mkdir -p /tmp/sfw-bin
-            printf '#!/bin/bash\nexec "%s" pnpm "$@"\n' "$SFW_BIN" > /tmp/sfw-bin/pnpm
-            chmod +x /tmp/sfw-bin/pnpm
-            export PATH="/tmp/sfw-bin:$PATH"
-          fi
-
           set +e
           pnpm build 2>&1 | tee build-output.log
           BUILD_EXIT=${PIPESTATUS[0]}
@@ -148,13 +133,6 @@ jobs:
           BUILD_LOG: ${{ steps.tests.outputs.BUILD_LOG }}
           TEST_LOG: ${{ steps.tests.outputs.TEST_LOG }}
         run: |
-          if [ -n "$SFW_BIN" ]; then
-            mkdir -p /tmp/sfw-bin
-            printf '#!/bin/bash\nexec "%s" pnpm "$@"\n' "$SFW_BIN" > /tmp/sfw-bin/pnpm
-            chmod +x /tmp/sfw-bin/pnpm
-            export PATH="/tmp/sfw-bin:$PATH"
-          fi
-
           set +e
           claude --print \
             --allowedTools "Bash(pnpm:*)" "Bash(git add:*)" "Bash(git commit:*)" "Bash(git status:*)" "Bash(git diff:*)" "Bash(git log:*)" "Bash(git rev-parse:*)" "Read" "Write" "Edit" "Glob" "Grep" \