Support PNPM - #4

Summary

This PR introduces the Node workflow in onix (pnpm import → generate → build → hydrate), and includes the core safeguards needed for real monorepos.

What This Adds

• Node packageset import from pnpm-lock.yaml (workspace-aware).
• Node derivation generation and project wiring for nodeModules.
• Node build/hydrate path for creating and materializing node_modules from Nix store artifacts.
• Warm-cache hydrate fast-path:
  • skips nix-build when identity is unchanged and target node_modules exists.
• Early link: workspace validation in generate:
  • fails fast with actionable diagnostics for unresolved required paths.
• Strict pnpm version policy with explicit override:
  • default remains strict.
  • onix import --allow-pnpm-patch-drift allows only same-major exact patch drift.
• Direct lockfile path support for standard pnpm lockfile names (pnpm-lock.yaml / pnpm-lock.yml).
• Documentation updates in README.md and AGENTS.md.

Why

• Establishes the intended two-layer onix model for Node:
  • global reusable artifact identity in the Nix store.
  • project-scoped composition via hydrate.
• Moves failures earlier (generate/import) instead of during long builds.
• Makes warm developer loops fast and predictable.

Validation

• Focused Node suites pass:
  • test/generate_node_test.rb
  • test/hydrate_node_test.rb
  • test/build_node_test.rb
  • test/pnpm_importer_test.rb
• Full test suite passes (rake test).
• onix check passes.
• Real-repo pilot validated on:
  • vercel/turborepo
  • vercel/swr
• Warm hydrate fast-path confirmed (node_modules unchanged) with sub-second timings.

Notes

• Ruby workflows are unchanged.