Mounting only ./backend and ./frontend into /app made pnpm look for a
per-package lockfile (stale) and miss the workspace-root one entirely,
so --frozen-lockfile failed and root pnpm.onlyBuiltDependencies didn't
apply. Mount the whole repo at /repo, install with --filter from root,
and use the canonical workspace lockfile. Drop the per-package
onlyBuiltDependencies overrides — pnpm warns they're ignored outside
the workspace root.
Pin node:22-bookworm: node:lts now resolves to Node 24, for which
isolated-vm@5.0.3 has no prebuild and won't compile (V8 headers
require C++20).
Gitignore stray per-package lockfiles so they don't drift again.
