Fixed deploy zips shipping pnpm files and repaired the ncc build

The zip step's hard-coded exclude list covered yarn* and npm* but not
pnpm*, so themes deployed from pnpm-based repos shipped pnpm-lock.yaml
and pnpm-workspace.yaml to the live Ghost site (found via the pnpm
migration in TryGhost/Themes#529, where all 16 demo-site deploys were
affected). Added pnpm* to the default excludes.

Preparing this fix surfaced that the build has been broken since
Renovate bumped @actions/core, @actions/exec, and slug to ESM-only
majors: the CommonJS source can no longer require() them, so ncc build
fails and dist has not been rebuildable since February. Load the three
packages via dynamic import() instead, keeping the source and dist
CommonJS so the node20 runtime keeps executing the action as before.

dist/ is intentionally not rebuilt in this commit; it must be
regenerated with yarn build (which works again with this change) when
the action is next shipped. Note ncc now also emits the dynamic imports
as async chunk files next to dist/index.js — they are part of the build
output and need to ship with it.

Author: aileen

index.js

@@ -1,11 +1,16 @@
 const path = require('path');
-const slug = require('slug');
-const core = require('@actions/core');
-const exec = require('@actions/exec');
 const GhostAdminApi = require('@tryghost/admin-api');
 
 (async function main() {
     try {
+        // slug and the @actions toolkit packages are ESM-only in their current
+        // majors, so they must be loaded via dynamic import from CommonJS.
+        const [core, exec, {default: slug}] = await Promise.all([
+            import('@actions/core'),
+            import('@actions/exec'),
+            import('slug')
+        ]);
+
         const url = core.getInput('api-url');
         const api = new GhostAdminApi({
             url,
@@ -26,7 +31,7 @@ const GhostAdminApi = require('@tryghost/admin-api');
             zipPath = themeZip;
 
             // Create a zip
-            await exec.exec(`zip -r ${themeZip} . -x *.git* *.zip yarn* npm* node_modules* *routes.yaml *redirects.yaml *redirects.json ${exclude}`, [], {cwd: basePath});
+            await exec.exec(`zip -r ${themeZip} . -x *.git* *.zip yarn* npm* pnpm* node_modules* *routes.yaml *redirects.yaml *redirects.json ${exclude}`, [], {cwd: basePath});
         }
 
         zipPath = path.join(basePath, zipPath);