chore(typescript): refuse a script run against a stale node_modules

A node_modules that predates the lockfile does not announce itself. It
surfaces as a type error inside whichever package the drifted dependency
types, in a file nobody touched, which reads as a source bug.

The worked example: `pnpm -r build` failing at
packages/dsh/src/fs.ts:88 with

  TS2345: Argument of type '"FS_TOO_LARGE"' is not assignable to
  parameter of type 'FsErrorCode'

on a checkout whose install predated 3bbb79121, the commit that bumped
@deepseek-ai/dsh-fs 0.0.1-rc.1 -> 0.1.0-rc.6 and with it the FsErrorCode
union that 88698fa08 then used. Source and lockfile were both correct;
only the install was behind, and the message pointed at neither.

pnpm can say that itself, so let it. `pnpm install` is the whole fix.

The setting has to live here rather than in .npmrc: inside a workspace
pnpm overwrites .npmrc settings from this file, so a
verify-deps-before-run= line there resolves in `pnpm config get` and is
still never consulted.

No effect on CI, which installs from the lockfile before it builds, and
none on a pull: verifyDepsBeforeRun is absent from pnpm's workspace-state
settings snapshot, so taking this commit does not itself invalidate an
up-to-date node_modules.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

typescript/pnpm-workspace.yaml

@@ -7,3 +7,11 @@ packages:
 
 onlyBuiltDependencies:
   - '@zkochan/fuse-native'
+
+# A node_modules older than the lockfile does not announce itself: it fails as
+# a type error inside whatever package the drifted dependency types, which
+# reads as a source bug in a file nobody touched. Refuse the script and name
+# the real cause instead. This has to live here rather than in .npmrc — inside
+# a workspace pnpm overwrites .npmrc settings from this file, so the
+# equivalent verify-deps-before-run= line there is silently inert.
+verifyDepsBeforeRun: error