chore(deps): docs on React 19, TypeScript 7 and pnpm 12

Renovate's #1405 (react monorepo), #1403 (typescript 7, which supersedes
the typescript-5.x branch) and #1404 (pnpm 12), taken together because
all three rewrite docs/package.json and its lockfile.

pnpm 12 needed two fixes Renovate couldn't make:
- docs.Dockerfile ran `corepack prepare pnpm@10.34.7`, a second pin next
  to package.json's packageManager. It now runs only `corepack enable`,
  so the packageManager field is the one version.
- pnpm 12 fails an install on any dependency build script nobody ruled
  on (ERR_PNPM_IGNORED_BUILDS). The only one is core-js's postinstall
  banner, which pnpm 10 skipped silently; docs/pnpm-workspace.yaml now
  says allowBuilds: core-js: false.

The lockfile was regenerated with pnpm 12.15.0 and passes its
supply-chain checks. The docs image builds, hadolint is clean, and /,
/api/ and search render headlessly with no page errors. The
broken-/category/-links warning is pre-existing: main's own build shows
it too.

docs/package.json

@@ -17,13 +17,13 @@
     "@mdx-js/react": "^3.1.1",
     "clsx": "^2.1.1",
     "prism-react-renderer": "^2.4.1",
-    "react": "^18.3.1",
+    "react": "^19.0.0",
-    "react-dom": "^18.3.1"
+    "react-dom": "^19.0.0"
   },
   "devDependencies": {
     "@docusaurus/module-type-aliases": "^3.10.2",
     "@docusaurus/types": "^3.10.2",
-    "typescript": "~5.6.3"
+    "typescript": "~7.0.0"
   },
   "browserslist": {
     "production": [
@@ -40,5 +40,5 @@
   "engines": {
     "node": ">=18.0"
   },
-  "packageManager": "pnpm@10.34.7"
+  "packageManager": "pnpm@12.15.0"
 }

docs/pnpm-workspace.yaml

@@ -0,0 +1,5 @@
+# pnpm settings for the docs site (no workspace packages). pnpm 12 fails an
+# install on any dependency build script nobody decided on; core-js's only
+# script is a postinstall banner, which pnpm 10 skipped silently anyway.
+allowBuilds:
+  core-js: false

infra/images/docs.Dockerfile

@@ -21,12 +21,15 @@ RUN uv run --with griffe python docs/scripts/extract_docs.py
 # Stage 2: Build Docusaurus static site
 FROM node:22-slim AS build
 
-RUN corepack enable && corepack prepare pnpm@10.34.7 --activate
+# No `corepack prepare <version>`: corepack runs the pnpm that
+# docs/package.json's packageManager names, so Renovate's bump of that
+# field is the whole upgrade (a second pin here went stale at pnpm 12).
+RUN corepack enable
 
 WORKDIR /docs
 
 # Install dependencies (pnpm for deterministic, fast installs)
-COPY docs/package.json docs/pnpm-lock.yaml ./
+COPY docs/package.json docs/pnpm-lock.yaml docs/pnpm-workspace.yaml ./
 RUN pnpm install --frozen-lockfile
 
 # Copy Docusaurus config and source