fix(galactica): permit insecure pnpm-9.15.9 for opencloud - #404

What broke

The Build & Cache workflow failed on master (commit ddd6ef5). Only galactica failed to build; every other host was fine.

Root cause — a real code failure, not CI infra noise:

error: Refusing to evaluate package 'pnpm-9.15.9' ... because it is marked as insecure
  Known issues:
   - CVE-2026-48995
   - CVE-2026-50014 ... (and more)

The eval trace shows it comes in through the opencloud service:

… while evaluating derivation 'opencloud-idp-web-7.0.0'
… while evaluating attribute 'nativeBuildInputs' of derivation 'opencloud-idp-web-7.0.0'

A recent nixpkgs bump started marking pnpm-9.15.9 as insecure (freshly published CVEs). Galactica's opencloud module builds opencloud-idp-web, which uses pnpm at build time, so the whole toplevel eval now refuses.

Fix

Add pnpm-9.15.9 to galactica's existing nixpkgs.config.permittedInsecurePackages list (this is build-time tooling for opencloud; the CVEs are in the pnpm CLI, not the served artifact). Scoped to galactica, the only host running opencloud.

Verification

Diagnosed from the CI logs — no Nix toolchain is available in this environment to build/just fmt locally. The change is a single string appended to an already-formatted list with matching indentation, so alejandra formatting is unaffected. CI will confirm the galactica build.

Other hosts

No other host failed in this run. The remaining log output was normal store-path copying, not errors.