chore(ci): remove vestigial pnpm setup from dependabot-auto-merge.yml

[os-warren]

Fixes #6392

Premise, re-verified on main at this branch's own HEAD (9602dc820)

Both halves confirmed before touching anything:

$ grep -n "merge\.pnpm-merge\.name\|merge\.pnpm-merge\.driver" .github/workflows/dependabot-auto-merge.yml
(no output, exit 1)                       # driver step is gone (#6389 merged)

$ grep -n "corepack enable\|pnpm --version" .github/workflows/dependabot-auto-merge.yml
92:        run: corepack enable
95:        run: pnpm --version           # both still present

What changed

Removed both pnpm steps (corepack enable, pnpm --version) from
dependabot-auto-merge.yml. actions/setup-node stays — the merge-gate script
is a node step and needs the runtime regardless.

Decision: cut both, don't keep pnpm --version as a fail-fast. The
reasoning is written into the workflow file itself (right where the two steps
used to be), summarized here:

• Nothing in this job calls pnpm today — its own next step already says it
  never runs pnpm install.
• The "proves corepack activated" fail-fast only matters once something in
  this job actually depends on pnpm, and nothing does. Keeping it is an
  unexplained two-line "just in case" setup with no consumer — which is the
  exact shape of residue this issue is about; keeping half of the removal
  recreates the same shape it names.
• If a future step here grows a real pnpm dependency, the corepack enable
  setup should go back in next to that step, where a reader can see what
  it's for, not sitting two steps away from its only would-be consumer.

The cache: 'pnpm' comment

Re-read, not reflex-deleted, per the card's warning. Its underlying claim
("this job never runs pnpm install, so a pnpm store cache would break
setup-node's post-job save") is still true and still the right warning for
the next person who reaches for cache: 'pnpm' on this job — reworded only to
note that the job doesn't set up pnpm at all any more, which makes the warning
even more clearly applicable, not less.

Scope

Only dependabot-auto-merge.yml's two pnpm lines. Per PM dispatch, #6391 (same
mechanism family) is explicitly out of scope for this PR — changeset- release.yml, the .gitattributes line, and the "Lockfile Merge Driver"
table's remaining row are untouched.

Tests

• pnpm exec vitest run scripts/__tests__/ (whole tree, as required because
  ci-cd-pipeline-doc.test.ts pins content/docs/guide/ci-cd-pipeline.md
  against .github/workflows/ in both directions): 81 test files passed,
  2317 tests passed, run at commit 121ae518e (this branch's head).
• node scripts/check-changeset-presence.mjs: confirms no published-package
  source changed and the changeset already added is sufficient — "No source of
  a released package changed in this range, so no changeset is owed."
• Re-parsed the edited YAML with python3 -c "import yaml; yaml.safe_load(...)"
  and listed the job's step names to confirm the two pnpm steps are gone and
  every other step (including actions/setup-node) is untouched.
• grep -rn "Enable Corepack\|Verify pnpm version" .github/workflows/ —
  confirms dependabot-auto-merge.yml no longer appears in that list while
  every workflow that genuinely runs pnpm install (ci.yml, lint.yml,
  changeset-release.yml, etc.) is untouched.

Changeset

.changeset/6392-vestigial-pnpm-steps.md, empty frontmatter (CI-only change,
no published package touched — objectui declares "no release" this way; the
skip-changeset label mechanism doesn't exist in this repo).

---

Generated by Claude Code