chore: let Corepack provision pnpm from package.json as single source of truth

Remove the duplicated PNPM_VERSION pin from devcontainer.json build args and
the Dockerfile ARG (which had drifted to 11.5.3 vs package.json's 11.5.0).
Corepack now reads package.json#packageManager at runtime; set
COREPACK_ENABLE_DOWNLOAD_PROMPT=0 so first-use provisioning is non-interactive.
Update docs accordingly.

.devcontainer/Dockerfile

@@ -3,10 +3,11 @@
 # or some Docker/Buildx versions can fail to parse it.
 FROM mcr.microsoft.com/devcontainers/javascript-node@sha256:21b17a0c1fd000eff7280c9eea21f04779d1825531b144e400e5d028a0d967b1
 
-ARG PNPM_VERSION=11.5.3
-
 ENV PNPM_HOME=/home/node/.local/share/pnpm
 ENV PATH=${PNPM_HOME}:${PATH}
+# Let Corepack provision the pnpm version from package.json#packageManager on
+# first use without an interactive download prompt.
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 
 # Install Chromium for Karma/ChromeHeadless test execution inside the container.
 # gnupg2 is required so VS Code can forward the host gpg-agent for signed commits.
@@ -14,9 +15,10 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends chromium gnupg2 \
     && rm -rf /var/lib/apt/lists/*
 
-# Configure Corepack-managed pnpm globally at image build time.
+# Enable Corepack shims. The pnpm version is not pinned here: Corepack reads
+# package.json#packageManager (the single source of truth) and provisions the
+# matching pnpm on first use during postCreateCommand.
 RUN corepack enable \
-    && corepack prepare pnpm@${PNPM_VERSION} --activate \
     && mkdir -p ${PNPM_HOME} /home/node/.pnpm-store \
     && chown -R node:node /home/node/.local /home/node/.pnpm-store
 USER node

.devcontainer/README.md

@@ -21,7 +21,7 @@ Rebuild (**Dev Containers: Rebuild Container**) after changing
 
 ## What's Included
 
-- Node base image (digest-pinned) with Corepack-activated **pnpm**
+- Node base image (digest-pinned) with **pnpm** provisioned by Corepack from `package.json#packageManager`
 - **Chromium** for Karma / `ChromeHeadless` tests (`CHROME_BIN` is preset)
 - **GitHub CLI** (`gh`) via the `github-cli` dev container feature
 - **gnupg2** so the host `gpg-agent` can be forwarded for signed commits

.devcontainer/devcontainer.json

@@ -5,10 +5,7 @@
   // Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
   "build": {
     "dockerfile": "Dockerfile",
-    "context": ".",
-    "args": {
-      "PNPM_VERSION": "11.5.3"
-    }
+    "context": "."
   },
 
   // Features to add to the dev container. More info: https://containers.dev/features.

docs/dev-containers.md

@@ -6,7 +6,7 @@ This repository includes a Dev Container configuration to provide a consistent l
 
 - Node-based development image defined in [.devcontainer/Dockerfile](../.devcontainer/Dockerfile)
 - Workspace configuration in [.devcontainer/devcontainer.json](../.devcontainer/devcontainer.json)
-- Pinned pnpm version via build arg and Corepack activation
+- pnpm provisioned by Corepack from `package.json#packageManager` (single source of truth)
 - Non-root development user configuration (node)
 - Persistent pnpm store volume for faster reinstall times