ci(remote-cache): run the standalone check with a native pnpm executable

`npm_execpath` points to pnpm's standalone executable on the Linux and
Windows runners, so running it through `node` failed. Run it directly
unless it's a JavaScript entry point.

The remote cache package also brought esbuild and workerd into the
workspace, and a root `pnpm install` without `--ignore-scripts` failed
on their unapproved build scripts. Allow them, as the standalone package
already does.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: wan9chi

.github/scripts/check-remote-cache-standalone.mjs

@@ -5,6 +5,8 @@ import { basename, join } from 'node:path';
 
 const pnpm = process.env.npm_execpath;
 if (!pnpm) throw new Error('Run this check through pnpm check-remote-cache-standalone');
+// pnpm can be a JavaScript entry point or a standalone executable.
+const [command, prefix] = /\.[cm]?js$/.test(pnpm) ? [process.execPath, [pnpm]] : [pnpm, []];
 const directory = await mkdtemp(join(tmpdir(), 'remote-cache-standalone-'));
 const excluded = new Set([
   'node_modules',
@@ -25,7 +27,7 @@ try {
   });
   for (const args of [['install', '--frozen-lockfile'], ['check'], ['build']]) {
     await new Promise((resolve, reject) => {
-      const child = spawn(process.execPath, [pnpm, ...args], {
+      const child = spawn(command, [...prefix, ...args], {
         cwd: directory,
         stdio: 'inherit',
         shell: false,

pnpm-workspace.yaml

@@ -8,6 +8,8 @@ allowBuilds:
   '@playwright/browser-chromium': true
   bun: true
   deno: true
+  esbuild: true
+  workerd: true
 
 minimumReleaseAgeExclude:
   - vite-plus