fix(codemod): write pnpm overrides to the workspace root - #97412

What?

next upgrade created a pnpm-workspace.yaml in the directory it was run
from. In a pnpm monorepo that is the app package, so the file now lands in the
workspace root instead, and the @types/react / @types/react-dom overrides
it writes are scoped to the package being upgraded.

Why?

The presence of pnpm-workspace.yaml is what defines a pnpm workspace root.
Writing one next to an app's package.json declared a nested root: the app
was cut off from the real one and stopped resolving its workspace:*
dependencies on sibling packages.

Overrides in a shared root apply to the whole workspace, so hoisting them
without scoping would force the upgraded app's @types/react version onto
unrelated packages.

Introduced in #94690.

How?

• Walk up from the current directory to the nearest pnpm-workspace.yaml,
  the way pnpm locates the workspace root, and write there. With no manifest
  anywhere above, the project is standalone and the file is still created in
  place — unchanged for single-package projects.
• Write scoped keys using pnpm's <package>><dependency> selector, e.g.
  '@fixture/web>@types/react': 19.2.18, so siblings keep their own
  resolution. Falls back to an unqualified key with a warning if the app's
  package.json has no name.
• Skip the rewrite when every override already holds the value the upgrade
  would set. js-yaml cannot round-trip comments, and re-running the upgrade
  should not repeatedly strip them from a file the tool does not own.
• Warn when writing into a shared root, naming the file, the scope, and the
  lost comments.

Verified on a real 13-package pnpm workspace running pnpm v11.21.0, upgrading
its Next.js app from 16.2.9 to 16.3.1: no pnpm-workspace.yaml was created
beside the app, the root manifest gained the scoped overrides, pnpm install
completed across all 13 projects, and the app's node_modules kept its
workspace symlinks.

⚠ pnpm only reads overrides from the workspace root, so "@repo/web>@types/react",
  "@repo/web>@types/react-dom" were written to "<root>/pnpm-workspace.yaml".
  They are scoped to "@repo/web" so the rest of the workspace is unaffected.
  Comments in that file were not preserved.

Also verified on a throwaway two-package workspace, where a second run with
unchanged versions wrote nothing and printed no warning, and a run after
clearing the overrides: block re-emitted it.

Known limitation, not changed here: an actual write still drops comments from
the manifest. Preserving them means swapping js-yaml for yaml.

Fixing a bug

• Related issues linked using fixes #number
• Tests added — bin/__testfixtures__/pnpm-v11-workspace-overrides/,
  following the existing manual fixture convention in that directory:
  pnpm test:upgrade-fixture bin/__testfixtures__/pnpm-v11-workspace-overrides/apps/web latest
• Errors have a helpful link attached — n/a, no new error

Fixes #98941