fix(scripts): name the real pnpm full-gate inputs

check:affected's full-gate list carried two placeholder filenames that exist
nowhere, leaving pnpm-lock.yaml, pnpm-workspace.yaml, and patches/ covered only
by the unknown-input fail-closed branch. Name them explicitly and cover them in
the fail-closed test. Point the preview-controller control-plane test at the
setup composite that actually exists, and record in pnpm-workspace.yaml why the
router-plugin unplugin override pins 3.0.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: FelixTJDietrich

pnpm-workspace.yaml

@@ -25,6 +25,8 @@ allowBuilds:
   protobufjs: false
 
 overrides:
+  # unplugin 3.1+ declares an optional peer on the retired runtime's types package, whose name
+  # would re-enter the lockfile and fail check:package-manager's repository-wide token ban.
   "@tanstack/router-plugin>unplugin": 3.0.0
   mermaid: 11.16.1
   vitest: 4.1.11

scripts/check-affected.test.ts

@@ -59,6 +59,9 @@ await test("maps scopes to the documented commands", () => {
 await test("fails closed for shared, generated, contract, tooling, and unknown inputs", () => {
 	for (const path of [
 		"package.json",
+		"pnpm-lock.yaml",
+		"pnpm-workspace.yaml",
+		"patches/zod@4.4.3.patch",
 		".oxlintrc.json",
 		"scripts/check-affected.ts",
 		"server/openapi.yaml",

scripts/check-affected.ts

@@ -33,8 +33,9 @@ const fullGateInputs = [
 	/^\.changeset\//,
 	/^scripts\//,
 	/^package\.json$/,
-	/^node\.lock$/,
-	/^nodefig\.toml$/,
+	/^pnpm-lock\.yaml$/,
+	/^pnpm-workspace\.yaml$/,
+	/^patches\//,
 	/^tsconfig(?:\.agents)?\.json$/,
 	/^\.ox(?:fmt|lint)rc\.json$/,
 	/^server\/openapi\.yaml$/,

scripts/preview-controller.test.ts

@@ -162,7 +162,7 @@ void describe("preview controller admission", () => {
 	void it("refuses PR-controlled changes to any part of the deployment control plane", async () => {
 		for (const filename of [
 			".github/workflows/reusable-docker-build.yml",
-			".github/actions/setup-node/action.yml",
+			".github/actions/setup-node-pnpm/action.yml",
 			"docker/preview/compose.app.yaml",
 			"docker/preview/.env.example",
 		]) {