Migrate to pnpm workspaces with automated npm publishing

[dannon]

Summary

• pnpm migration: Replaced Yarn + Lerna with pnpm workspaces. All 48 packages resolve and install successfully. Root package.json has convenience scripts (build:all, test:all, lint:all, clean).
• Automated publishing: New publish-packages.yml workflow detects version bumps on merge to main and publishes changed packages to npm under @galaxyproject. Manual publish workflow with dry-run support also included.
• Test workflow updated: Existing test workflow adapted for pnpm (pnpm store caching, pnpm install --frozen-lockfile from root, Node 22). Kept the dynamic discovery, Playwright separation, and Python dependency support.
• Prettier consolidated: Moved 30 identical per-package prettier.config.js files to a single root config. Added .prettierignore.
• Package cleanup: Scoped webr as @galaxyproject/webr, replaced hardcoded yarn calls in build scripts, removed 12 stale per-package yarn.lock files.

Build/test verification

• pnpm install — all 48 workspace packages resolve
• 33/40 packages with build scripts build successfully (7 failures are pre-existing dependency issues)
• 4/4 unit-test-only packages pass locally (Playwright tests require CI server environment)

Notes

• Requires NPM_TOKEN secret in repo settings for publishing to work
• No package versions were changed (won't trigger any publishes on merge)

Test plan

• CI test workflow passes on this PR
• Verify pnpm install && pnpm build:all works locally
• After merge, confirm publish workflow runs but skips (no version changes)
• Test manual publish workflow with dry-run on a single package

[davelopez]

This is very helpful! Thank you!

[dannon]

TODO: Set up npm trusted publishing (OIDC)

The publish workflows currently reference an NPM_TOKEN secret. Before enabling publishing, we should switch to npm trusted publishing via OIDC instead -- no long-lived tokens needed, npm verifies the publish came from an authorized GitHub Actions workflow.

Setup steps:

1. Use the npm trust CLI to configure trusted publishing in bulk for all @galaxyproject packages:

   for pkg in $(ls packages/); do
     npm trust github \
       --package "@galaxyproject/$pkg" \
       --repository "galaxyproject/galaxy-visualizations" \
       --workflow "publish-packages.yml" \
       --yes
     sleep 2
   done

   First run prompts for 2FA -- check "skip 2FA for 5 minutes" on the npm site to let the rest go through.

2. Repeat with --workflow "manual-publish.yml" for the manual publish workflow (if npm supports multiple workflows per publisher -- otherwise we may need to consolidate).

3. Update the workflow YAML files to use OIDC: add permissions: id-token: write, use npm publish --access public --provenance, and drop the NPM_TOKEN env var.

Caveat: Initial version of any never-published package can't use OIDC -- needs a one-time token-based publish first.

Ref: https://docs.npmjs.com/trusted-publishers/ / https://docs.npmjs.com/cli/v11/commands/npm-trust/