chore: Pin pnpm 10 in Volta and remove .npmrc (#25641)

This changes the Volta pnpm pin from 9.15.9 to 10.34.6 and removes the
root `.npmrc`. Volta cannot start pnpm 11 or newer
([volta-cli/volta#2114](volta-cli/volta#2114)),
and pnpm 10 switches to the `packageManager` version by default, so
`manage-package-manager-versions=true` is not needed. `package.json` and
`CONTRIBUTING.md` now explain the pin and that it needs
`VOLTA_FEATURE_PNPM=1` in the shell profile.

## Why

- `pnpm test --watch` failed locally with `Unknown option: 'watch'`,
because pnpm 9 reads the options of its `test` command before it
switches.
- npm warned `Unknown project config "manage-package-manager-versions"`
at every call in the repo.
- Without `VOLTA_FEATURE_PNPM=1`, Volta ignores the pin, and the docs
did not name the variable.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: JPeer264

.agents/skills/fix-security-vulnerability/scripts/classify-alerts.mjs

@@ -69,7 +69,7 @@ function fetchOpenAlerts() {
 }
 
 // Resolve a dependency's installed directory, preferring the consumer's nested node_modules and
-// falling back to the hoisted root node_modules (`node-linker=hoisted` in .npmrc hoists most deps to the root).
+// falling back to the hoisted root node_modules (`nodeLinker: hoisted` in pnpm-workspace.yaml hoists most deps to the root).
 function resolveDepDir(name, baseDir) {
   const candidates = [join(baseDir, 'node_modules', name), join(REPO_ROOT, 'node_modules', name)];
   return candidates.find(dir => existsSync(join(dir, 'package.json')));

.npmrc

@@ -14,8 +14,9 @@ Developer Documentation.
 
 ## Setting up an Environment
 
-We use [Volta](https://volta.sh/) to ensure we use consistent versions of node and pnpm. Make sure to enable
-[pnpm support in Volta](https://docs.volta.sh/advanced/pnpm).
+We use [Volta](https://volta.sh/) to ensure we use consistent versions of node and pnpm. Volta manages pnpm only when
+[pnpm support](https://docs.volta.sh/advanced/pnpm) is enabled, so add `export VOLTA_FEATURE_PNPM=1` to your shell
+profile (for example `~/.zshrc`).
 
 `sentry-javascript` is a monorepo containing several packages, managed with pnpm workspaces and Nx. To get started,
 install all dependencies, and then perform an initial build, so TypeScript can read all of the linked type definitions.

CONTRIBUTING.md

@@ -49,9 +49,13 @@
     "yalc:publish": "nx run-many -t yalc:publish"
   },
   "packageManager": "pnpm@12.11.2",
+  "//_volta_comment": [
+    "Volta cannot start pnpm 11 or newer (volta-cli/volta#2114). It starts this pnpm 10 version, which switches to the `packageManager` version.",
+    "Volta reads the pnpm version only when `VOLTA_FEATURE_PNPM=1` is set, see CONTRIBUTING.md."
+  ],
   "volta": {
     "node": "24.22.1",
-    "pnpm": "9.15.9"
+    "pnpm": "10.34.6"
   },
   "//_workspaces_comment": [
     "pnpm reads the workspace packages from pnpm-workspace.yaml. Deno and the repo scripts read this list.",