chore(generator): move gapic-generator-typescript off Bazel into the root pnpm workspace

[bshaffer]

Split into reviewable pieces. Land these first, then merge main here and this PR shrinks to just the generator change:

• chore: drop dead nested pnpm-lock.yaml files #9410 — drop dead nested pnpm-lock.yaml files
• chore(ci): run update-api-list on pnpm #9411 — run update-api-list on pnpm
• chore(ci): move update-api-list to pnpm and drop dead nested lockfiles #9412 — move librarian to pnpm 10

What's left here

The Bazel WORKSPACE contained npm_translate_lock(pnpm_lock = "//:pnpm-lock.yaml"), hard-wiring Bazel to the generator's nested lockfile. So removing Bazel and moving the generator into the root workspace cannot be separated — they're one change.

Hand-written surface is ~150 lines:

File	What
pnpm-workspace.yaml	add the generator as a member
typescript/src/generator.ts	protobufjs v7/v8 cast bridge + rationale
package.json	drop @bazel/bazelisk and a dead npm-style overrides
.github/workflows/generator-tests.yaml	bazelisk → pnpm + protoc

Everything else is generated-file deletion (WORKSPACE, BUILD.bazel, MODULE.bazel, .bazelrc, package-lock.json, the nested pnpm-lock.yaml) plus the root lockfile update. Reviewers: filter out *lock* and this is 4 files.

On the protobufjs casts

proto3-json-serializer@4 (latest) hard-depends on protobufjs@^7; the generator wants ^8. Hoisting into the root workspace loses the nested pnpm.overrides that used to unify them, so TypeScript now sees two protobufjs type trees.

Fixing this with a root pnpm.overrides entry does not work — it was tried in 2cc19a6 and broke all 18 units shards, because it forces protobufjs@8 onto google-gax, which needs v7. The casts are the correct fix until upstream supports v8. Documented inline so nobody retries the override.

Known follow-ups (not addressed here)

1. The Bazel removal is incomplete: .bazeliskrc, repositories.bzl (loaded by the deleted WORKSPACE), and rules_typescript_gapic/ survive unreferenced.
2. Four steps in generator-tests.yaml (lines ~159-180) are gated on steps.generator-changes.outputs.changes, but no step defines id: generator-changes — they have never run. They also use generator/... paths missing the core/ prefix. These are the combined-library Speech/Tasks tests, and the only consumer of rules_typescript_gapic/ from (1).

Needs a call on whether those tests should be revived or deleted.

[gemini-code-assist]

Code Review

This pull request removes Bazel build configuration files and integrates the gapic-generator-typescript package directly into the pnpm workspace. It also updates TypeScript type assertions in generator.ts to resolve compilation issues and modifies the installation command in librarian.yaml. Feedback suggests removing the --force flag from the pnpm install command in librarian.yaml to prevent unnecessary slowdowns in the build pipeline.

[bshaffer]

Closing. This PR has been split into two reviewable pieces, and its one remaining idea was dropped on purpose.

#9413	generator: remove Bazel, build with pnpm (generator stays standalone)
#9412	CI: finish the move to pnpm 10 (generation_check.yaml, update-api-list.yaml, librarian.yaml, dead lockfiles)

Dropped: moving the generator into the root pnpm workspace.

1. Librarian builds the released generator from a pinned tarball with --ignore-workspace (src_dir is a path inside the fetched archive). Workspace membership buys the production path nothing.
2. Workspace membership is the sole cause of the --no-frozen-lockfile reproducibility regression. Standalone + a 9.0 lockfile means --frozen-lockfile keeps working.
3. It costs type safety. In the root workspace, proto3-json-serializer@4 pins protobufjs@^7 while the generator needs ^8, and there is no per-project override in pnpm 10 — so generator.ts needs casts. A root pnpm.overrides.protobufjs is not an option: 2cc19a6 tried it and broke all 18 units shards (it forces protobufjs@8 onto google-gax, which needs v7); reverted in 05c2a62.
4. It silently changes CI to test the generator against local sources instead of the published packages librarian actually installs.