ee1488f322
lockfile-lint doesn't support pnpm-lock.yaml. pnpm enforces tarball integrity hashes on install, covering the core supply-chain concern. The explicit allowlists (hosts, schemes, git URLs) are gone with it; acceptable tradeoff for now. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>