[Stage 1.1] Adopt pnpm and verify the current package tarball

[draedful]

Parent: #318

Goal

Adopt the v2 workspace package manager and prove the current root package as an installable artifact before changing its location.

This task establishes a real consumer check as part of the migration result, not as a standalone verification-only stage.

Scope

• Declare pnpm as the repository package manager and create the pnpm lockfile and workspace configuration.
• Remove npm lockfile usage and migrate development and CI commands on the v2 line to pnpm.
• Build and pack the current root @gravity-ui/graph package.
• Install the generated tarball into isolated vanilla JavaScript and React consumer fixtures.
• Verify runtime and TypeScript imports from @gravity-ui/graph and @gravity-ui/graph/react.
• Verify required styles and published assets from the packed artifact.
• Ensure the fixtures cannot resolve repository source files or workspace links.
• Keep the existing unit, Storybook, and E2E workflows operational.

Acceptance criteria

• A clean checkout installs with pnpm and a frozen lockfile.
• The current root package produces an npm-compatible tarball.
• Vanilla JavaScript and React fixtures install only that tarball.
• Consumer type checking, bundling, and minimal runtime smoke checks pass.
• Required styles and package assets are present.
• Existing library tests, Storybook build, and E2E checks still pass.
• No package-lock.json or npm-based CI command remains on the v2 line.