fix(ci): declare packageManager so pnpm/action-setup picks the right version

pnpm/action-setup@v3 needs to know which pnpm version to install,
either via a `version:` input in the workflow YAML or via the
`packageManager` field of package.json. Neither was set, so the
action's self-installer aborts with `No pnpm version is specified`,
breaking every CI job that calls it (check, scan, perf, commits).

Add `"packageManager": "pnpm@10.33.2"` to package.json — single
source of truth for the workspace, also picked up by `corepack` so
local dev gets the same version automatically. Workflow YAMLs stay
untouched (the action reads packageManager directly).

Pinned to the exact 10.33.2 that the workspace was bootstrapped with.
Future bumps go through a `chore(deps):` PR and update this field
explicitly so CI and local dev stay in lockstep.

package.json

@@ -2,6 +2,7 @@
   "name": "apf-portal",
   "version": "0.0.0",
   "license": "MIT",
+  "packageManager": "pnpm@10.33.2",
   "scripts": {
     "prepare": "husky",
     "ci:check": "pnpm exec nx affected -t format:check lint test build",