chore(node, pnpm): bump to Node v26.0.0 + pnpm 11.0.6 with sha512

Root engines.node: >=25.9.0 → >=26.0.0; pnpm range: >=11.0.0-rc.3 →
>=11.0.6. The packageManager field carries an integrity hash in the
corepack-mandated hex form (RFC 2018), so corepack verifies the
downloaded pnpm tarball before trusting it.

Subpackage engines drop: build-infra and package-builder are
private workspace-only packages with no published surface — their
engines.node fields were drift-prone (>=25.5.0 vs root >=25.9.0)
without serving any consumer. Per the new socket-repo-template
CLAUDE.md rule "monorepo-internal subpackages don't need engines",
the field is removed entirely. The root package.json's engines is
the single source of truth for the workspace.

Tracks the SocketDev/socket-registry/external-tools.json bump
(commit 9246c28b) which moved pnpm to 11.0.6 in the canonical CI
pin and migrated the schema from per-platform sha256 fields to
SRI-format integrity strings.

Author: jdalton

package.json

@@ -1,11 +1,11 @@
 {
   "name": "socket-cli-monorepo",
   "version": "0.0.0",
-  "packageManager": "pnpm@11.0.0-rc.5",
+  "packageManager": "pnpm@11.0.6+sha512.97f906e1da2bedac3df83cadae04b4753a130092dd49d55cd36825ad3e623e9df3f97754f8f259e699172a360fac569acf2f908e7732bdae3eddb2dcf7e121fd",
   "private": true,
   "engines": {
-    "node": ">=25.9.0",
-    "pnpm": ">=11.0.0-rc.3"
+    "node": ">=26.0.0",
+    "pnpm": ">=11.0.6"
   },
   "scripts": {
     "// Build": "",

packages/build-infra/package.json

@@ -25,9 +25,5 @@
     "@sinclair/typebox": "catalog:",
     "@socketsecurity/lib": "catalog:",
     "magic-string": "catalog:"
-  },
-  "engines": {
-    "node": ">=25.5.0",
-    "pnpm": ">=10.22.0"
   }
 }

packages/package-builder/package.json

@@ -18,8 +18,5 @@
     "@socketsecurity/lib": "catalog:",
     "build-infra": "workspace:*",
     "handlebars": "^4.7.9"
-  },
-  "engines": {
-    "node": ">=25.5.0"
   }
 }