fix(notebooks): keep upstream pnpm-lock in overlay build — editor crashed on floated deps

The overlay deleted marimo's pnpm-lock.yaml before 'pnpm install
--no-frozen-lockfile', so every image build re-resolved the entire
dependency graph (devDeps included — rolldown-vite beta among them) to
latest-of-the-day. The 0.23.13 rebuild on 2026-07-08 produced a bundle
that compiled clean but crashed the editor at runtime on every notebook
open: 'TypeError: d is not a constructor' in the @codemirror/merge
chunk (new StyleModule(...) receiving a non-constructor after bad
bundler interop). The home page still rendered and the container
reported healthy, so nothing caught it.

Keep the lockfile: --no-frozen-lockfile already re-resolves only what
the overlay actually changes (@tabler/icons-react + the two overrides);
everything else stays at the versions upstream tested and shipped.

Verified: rebuilt image, headless-browser probe of the editor on a
throwaway container (0 console errors, cells render), then recreated
the production container and re-probed — clean. Frontend smoke gate in
CI to prevent recurrence is designed and pending approval.

infra/marimo/theme/scripts/apply-overlay.sh

@@ -44,8 +44,13 @@ else
   printf '\noverrides:\n  jotai: "2.17.0"\n  tailwind-merge: "2.6.0"\n' >> "$WS"
 fi
 
-# 3. Rewrite pnpm-lock if it exists so pnpm install doesn't error on drift.
-rm -f "$SRC/frontend/pnpm-lock.yaml" "$SRC/pnpm-lock.yaml"
+# 3. KEEP upstream's pnpm-lock.yaml. We install with --no-frozen-lockfile,
+#    which re-resolves only what the overlay changed (the @tabler dep and
+#    the overrides above) and keeps every other transitive dep — including
+#    devDeps like rolldown-vite — at the versions upstream tested and
+#    shipped. Deleting the lock floated the whole graph to latest-of-the-day
+#    and produced a bundle that built fine but crashed the editor at runtime
+#    ("d is not a constructor" in @codemirror/merge, 2026-07-09).
 
 # 4. Inject our CSS import into globals.css.
 #    `@import` must precede all other statements (postcss/CSS spec), so