pnpm

fix: update vulnerable dependencies (#12503)

fix(ci): grant pull-requests: write so the review label step can label PRs (#12501)

test(exec): fix Windows failure in PnP require option test (#12499)

chore: update lockfile, Node.js, pnpm, and pacquet versions (#12441)

fix(ci): run PR review automation for fork PRs via workflow_run (#12493)