fix(notebooks): pin jotai 2.17.0 in marimo overlay to fix frontend build

The overlay mutates marimo's package.json, so the image builds with
`pnpm install --no-frozen-lockfile`. That let pnpm re-resolve jotai within
marimo's `^2.17.0` range up to 2.20.0+, which dropped the
INTERNAL_getBuildingBlocksRev2 / INTERNAL_buildStoreRev2 exports that
marimo's source imports — the frontend build then died with MISSING_EXPORT.

Pin jotai to the exact version via pnpm.overrides in apply-overlay.sh. The
jq transform creates the overrides (and pnpm) key when absent and preserves
any existing overrides.

infra/marimo/theme/scripts/apply-overlay.sh

@@ -21,6 +21,16 @@ jq '.dependencies["@tabler/icons-react"] = "^3.26.0"' \
   "$SRC/frontend/package.json" > "$SRC/frontend/package.json.new"
 mv "$SRC/frontend/package.json.new" "$SRC/frontend/package.json"
 
+# 2b. Pin jotai to the exact version marimo's lockfile expects. We build with
+#     `pnpm install --no-frozen-lockfile` (the overlay mutates package.json),
+#     so pnpm otherwise re-resolves jotai within marimo's `^2.17.0` range up to
+#     2.20.0+, which dropped the INTERNAL_getBuildingBlocksRev2 /
+#     INTERNAL_buildStoreRev2 exports marimo's source imports → the frontend
+#     build dies with MISSING_EXPORT. Add it to the existing pnpm.overrides.
+jq '.pnpm.overrides.jotai = "2.17.0"' \
+  "$SRC/package.json" > "$SRC/package.json.new"
+mv "$SRC/package.json.new" "$SRC/package.json"
+
 # 3. Rewrite pnpm-lock if it exists so pnpm install doesn't error on drift.
 rm -f "$SRC/frontend/pnpm-lock.yaml" "$SRC/pnpm-lock.yaml"