ci: pin pnpm version

[janvennemann]

Summary

• Pin pnpm via packageManager to 10.33.3
• Let pnpm/action-setup read the packageManager field instead of installing latest

Test Plan

• node -e "const fs = require('node:fs'); const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8')); if (pkg.packageManager !== '[email protected]') process.exit(1); console.log(pkg.packageManager);"
• git diff --check

Note: full local coverage was not rerun for this PR because the branch has a separate known ti sdk uninstall regression.

[cb1kenobi]

We really need to drop Node 20 and ship Titanium CLI 9.0. A number of dependabot PRs are stuck due to Node 20, including the pnpm 11 stuff.