fix(ci): use Vercel CLI compatible with pnpm 12

[yamcodes]

Summary

• upgrade the pinned Vercel CLI used by preview deployments
• avoid Vercel CLI 54 passing the removed --unsafe-perm option to pnpm 12

Validation

• git diff --check
• verified vercel@59.16.0 installs and reports the expected version

Fixes the preview deployment failure reported by run 34621903135.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2c8c074

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pullfrog]

Important

The version bump itself is correct and verified, but as submitted it only edits the workflow copy on v1 — while the failing run this PR cites (34621903135) is on dev, which still pins vercel@54.7.1 and stays broken until it gets the same change. Please confirm the fix is also landing on dev (and the two other deploy workflows).

Reviewed changes

This run reviewed commit 5e737f43 (initial review) — a one-file CI change bumping the pinned Vercel CLI from vercel@54.7.1 to vercel@59.16.0 in .github/workflows/preview-www-reusable.yml, with comments explaining the pnpm-12 --unsafe-perm incompatibility.

I verified the underlying diagnosis independently:

• vercel@54.7.1's bundled @vercel/build-utils@13.26.5 builds the pnpm command as ["install", "--unsafe-perm"]; the failing run's log (error: unexpected argument '--unsafe-perm' found from pnpm 12.0.0 via corepack, driven by "pnpm@12.0.0" in package.json) matches. pnpm 11.9.0 and 11.24.0 both still accept the flag; pnpm 12.0.0 rejects it.
• vercel@59.16.0 bundles @vercel/build-utils@14.10.0, which no longer references unsafe-perm (verified in installed dist, and its changelog entry "Remove --unsafe-perm from npm install command"). Node engine >= 18 is fine for the runner's LTS.

⚠️ Not the branch that's failing — fix needs to also land on dev

The run referenced in the PR description (34621903135, "Preview www (Default Events)") fired on dev, which pins pnpm@12.0.0 in package.json — that is where the incompatibility actually bites. v1 pins pnpm@11.9.0, which accepts --unsafe-perm, and v1's preview deploy at its own head succeeded end-to-end with vercel@54.7.1 as recently as 2026-09-11 16:49 UTC (run 34624160608, head b26786b4). So this PR as submitted does not fix the failure it claims to fix: dev and main's copies of .github/workflows/preview-www-reusable.yml still pin vercel@54.7.1, and the same is true of .github/workflows/deploy-www.yml and .github/workflows/deploy-www-manual.yml on all branches.

The change is still worth making on v1 (it removes a live footgun for the moment v1 syncs pnpm 12 from dev, and the bump is behaviorally inert today), but the PR title, description, and comment all frame it as fixing the reported run failure.

Technical details

# Branch-targeting of the Vercel CLI pin bump

## Affected sites
- branch `dev`, `.github/workflows/preview-www-reusable.yml:73` — still `vercel@54.7.1`; dev preview deploys remain broken (pnpm@12.0.0)
- branch `main`, `.github/workflows/preview-www-reusable.yml:73` — still `vercel@54.7.1` (currently ok only because main pins pnpm@11.24.0)
- all branches, `.github/workflows/deploy-www.yml:45` and `.github/workflows/deploy-www-manual.yml:71` — still pin `vercel@54.7.1`; deploy-www-manual can check out a dev SHA (pnpm 12) and would reproduce the failure

## Required outcome
- The cited preview failure (run 34621903135) is on `dev`; the same `vercel@59.16.0` bump must land on `dev`'s copy of `preview-www-reusable.yml` (and ideally `main`), or a separate dev PR is opened — otherwise the reported failure persists after this PR merges.

## Open questions for the human
- Is this PR meant as a v1-side hardening ahead of v1 adopting pnpm 12, with a separate dev fix to come? If so, clarify the description/comment so the "fixes run 34621903135" claim is accurate.
- Should `deploy-www.yml` / `deploy-www-manual.yml` get the same bump in the same change (or a follow-up)?

ℹ️ Nitpicks

• Comment wording nit: "a version that supports the workspace's pnpm" slightly overstates — the incompatibility is with the removed --unsafe-perm flag specifically, not with pnpm 12 broadly. The current phrasing is fine; the real point is the flag.
• No lockfile/changeset considerations apply (CI-only change, no package graph impact).

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

Run failed. View the logs →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[yamcodes]

No changeset is needed here. This PR only changes CI workflow configuration and does not modify a published package or require a package version bump.

[yamcodes]

Declined as unrelated to the code change. This Pullfrog review run failed from its own timeout/auth retry path, not from the repository workflows; the workflow changes have been validated locally and pushed.