Address workspace diff review findings

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/pr.yml

@@ -62,6 +62,13 @@ jobs:
             pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
           fi
 
+      - name: Upload resolved lockfile
+        uses: actions/upload-artifact@v4
+        with:
+          name: pr-pnpm-lock-${{ github.run_id }}
+          path: pnpm-lock.yaml
+          retention-days: 1
+
   verify:
     needs: [policy]
     runs-on: ubuntu-latest
@@ -82,12 +89,13 @@ jobs:
           node-version: 24
           cache: pnpm
 
+      - name: Use policy-resolved lockfile
+        uses: actions/download-artifact@v4
+        with:
+          name: pr-pnpm-lock-${{ github.run_id }}
+
       - name: Install dependencies
-        run: |
-          pnpm install --frozen-lockfile || {
-            echo "Frozen lockfile install failed; retrying without frozen lockfile because PRs do not commit pnpm-lock.yaml."
-            pnpm install --no-frozen-lockfile
-          }
+        run: pnpm install --frozen-lockfile
 
       - name: Typecheck workspaces whose build scripts skip TypeScript
         run: pnpm run typecheck:build-gaps
@@ -138,12 +146,13 @@ jobs:
           node-version: 24
           cache: pnpm
 
+      - name: Use policy-resolved lockfile
+        uses: actions/download-artifact@v4
+        with:
+          name: pr-pnpm-lock-${{ github.run_id }}
+
       - name: Install dependencies
-        run: |
-          pnpm install --frozen-lockfile || {
-            echo "Frozen lockfile install failed; retrying without frozen lockfile because PRs do not commit pnpm-lock.yaml."
-            pnpm install --no-frozen-lockfile
-          }
+        run: pnpm install --frozen-lockfile
 
       - name: Run serialized server test shard
         run: pnpm test:run:serialized -- --shard-index ${{ matrix.shard_index }} --shard-count ${{ matrix.shard_count }}
@@ -169,12 +178,13 @@ jobs:
           node-version: 24
           cache: pnpm
 
+      - name: Use policy-resolved lockfile
+        uses: actions/download-artifact@v4
+        with:
+          name: pr-pnpm-lock-${{ github.run_id }}
+
       - name: Install dependencies
-        run: |
-          pnpm install --frozen-lockfile || {
-            echo "Frozen lockfile install failed; retrying without frozen lockfile because PRs do not commit pnpm-lock.yaml."
-            pnpm install --no-frozen-lockfile
-          }
+        run: pnpm install --frozen-lockfile
 
       # `release.sh` always executes its Step 2/7 workspace build, even when
       # `--skip-verify` bypasses the initial verification gate.
@@ -204,12 +214,13 @@ jobs:
           node-version: 24
           cache: pnpm
 
+      - name: Use policy-resolved lockfile
+        uses: actions/download-artifact@v4
+        with:
+          name: pr-pnpm-lock-${{ github.run_id }}
+
       - name: Install dependencies
-        run: |
-          pnpm install --frozen-lockfile || {
-            echo "Frozen lockfile install failed; retrying without frozen lockfile because PRs do not commit pnpm-lock.yaml."
-            pnpm install --no-frozen-lockfile
-          }
+        run: pnpm install --frozen-lockfile
 
       - name: Install Playwright
         run: npx playwright install --with-deps chromium