fix(ci): avoid blocked pnpm action

[Windsor Nguyễn (windsornguyen)]

Keep BSMR on Blacksmith while making generated CI schedulable under the enterprise action allowlist.

What does this change?

Replaces pnpm/action-setup with npm install --global pnpm@10.30.3 in the Hollywood TypeScript source and regenerates the checked-in workflow.

The sized Blacksmith runners remain unchanged. Existing Swatinem/rust-cache behavior and its single trusted main writer also remain unchanged.

Why?

GitHub rejected the generated workflow at startup because pnpm/action-setup is outside the enterprise action allowlist. No jobs were scheduled.

The public Docker-image leak is contained at the actual boundary: the organization-wide Blacksmith Docker Container Caching feature is disabled. Blacksmith exposes no per-repository control for that cache today. Actions cache, sticky disks, Git caching, Bazel/Buck2 caching, and Blacksmith runners remain enabled.

No issue: targeted CI incident containment.

How was it tested?

• pnpm run ci test - 13 passed.
• pnpm run ci check - generated workflow parity, action bundle, typecheck, and workflow security passed.
• git diff --check
• Reloaded Blacksmith organization Features settings and verified Docker Container Caching remains disabled.
• PR CI run 30674720504 passed every check.
• Rust Tests ran on Blacksmith 16-vCPU in 4m18s; Quality and Self-host ran on Blacksmith 8-vCPU in 2m49s and 3m15s.
• All three Rust lanes hit and restored the existing bsmr-v1-rust cache.
• All three complete public logs contain no internal Docker image names or manifests. Teardown reports only that Docker container caching is disabled and skips hash computation.

Notes

The transparent Docker cache should stay disabled until Blacksmith provides repository-scoped trust groups or a per-repository exclusion plus image-inventory log redaction.