fix(ci): post-runner-image cleanup

Three follow-up fixes uncovered by the first end-to-end CI run on the
self-hosted act_runner image:

- Replace `nrwl/nx-set-shas@v4` with a manual shell step. The action
  queries the GitHub API to discover the last successful workflow run
  and returns 404 on Gitea. The replacement derives NX_BASE/NX_HEAD
  from local git history (merge-base with the target branch on
  pull_request, HEAD~1 on push to main).
- Pin the `perf` job to `catthehacker/ubuntu:full-22.04` so Lighthouse
  CI finds a real Chrome. The default act image (act-22.04) is the
  minimal variant and ships without browsers.
- Declare `pnpm.onlyBuiltDependencies` to silence the "Ignored build
  scripts" warning and approve only the packages whose post-install
  hooks we actually rely on (Nx, Prisma, esbuild, swc, native
  watchers/resolvers).

package.json

@@ -16,6 +16,22 @@
       "prettier --write"
     ]
   },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@nestjs/core",
+      "@parcel/watcher",
+      "@prisma/client",
+      "@prisma/engines",
+      "@swc/core",
+      "esbuild",
+      "less",
+      "lmdb",
+      "msgpackr-extract",
+      "nx",
+      "prisma",
+      "unrs-resolver"
+    ]
+  },
   "devDependencies": {
     "@analogjs/vite-plugin-angular": "~2.1.2",
     "@analogjs/vitest-angular": "~2.1.2",