fix(lock): commit the regenerated pnpm-lock.yaml (#119 F1 recurrence)

The prior F1 fix regenerated the lock in the working tree but a multi-pathspec
`git add` (that also named an already-`git rm`'d file) aborted before staging
pnpm-lock.yaml, so only the F2 deletion landed in a2e63e7e — the pushed lock was
still missing `@docmost/git-sync` in the apps/server importer and CI/Docker were
red at `pnpm install --frozen-lockfile`. Root cause (per reviewer): develop's
apps/server does NOT depend on git-sync (it lives only on this branch), so every
develop merge auto-resolves the lock's apps/server importer to the develop
version and silently drops git-sync — the lock must be regenerated and committed
AFTER each merge. This commits the regenerated lock (git-sync back in the
apps/server importer).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

pnpm-lock.yaml

@@ -534,6 +534,9 @@ importers:
       '@clickhouse/client':
         specifier: ^1.18.2
         version: 1.18.2
+      '@docmost/git-sync':
+        specifier: workspace:*
+        version: link:../../packages/git-sync
       '@docmost/mcp':
         specifier: workspace:*
         version: link:../../packages/mcp
@@ -16153,7 +16156,7 @@ snapshots:
       obug: 2.1.1
       std-env: 4.1.0
       tinyrainbow: 3.1.0
-      vitest: 4.1.6(@opentelemetry/api@1.9.0)(@types/node@25.5.0)(@vitest/coverage-v8@4.1.6)(happy-dom@20.8.9)(jsdom@27.4.0(@noble/hashes@2.0.1))(vite@8.0.5(@types/node@25.5.0)(esbuild@0.28.0)(jiti@2.4.2)(less@4.2.0)(sugarss@5.0.1(postcss@8.5.14))(terser@5.39.0)(tsx@4.21.0)(yaml@2.8.3))
+      vitest: 4.1.6(@opentelemetry/api@1.9.0)(@types/node@22.19.1)(@vitest/coverage-v8@4.1.6)(happy-dom@20.8.9)(jsdom@25.0.0)(vite@8.0.5(@types/node@22.19.1)(esbuild@0.28.0)(jiti@2.4.2)(less@4.2.0)(sugarss@5.0.1(postcss@8.5.14))(terser@5.39.0)(tsx@4.21.0)(yaml@2.8.3))
 
   '@vitest/expect@4.1.6':
     dependencies: