fix(ci): isolate pnpm setup per runner

scripts/ci-workflow.spec.ts

@@ -0,0 +1,33 @@
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import * as yaml from 'js-yaml'
+import { describe, expect, it } from 'vitest'
+
+const root = resolve(import.meta.dirname, '..')
+const runnerPrivatePnpmDestination = '${{ runner.temp }}/setup-pnpm'
+
+describe('CI workflow', () => {
+  it('isolates every pnpm action setup destination per runner', () => {
+    const workflow: unknown = yaml.load(readFileSync(resolve(root, '.github/workflows/ci.yml'), 'utf8'))
+    if (!isRecord(workflow) || !isRecord(workflow.jobs)) throw new TypeError('CI workflow must define jobs')
+
+    const setups = Object.entries(workflow.jobs).flatMap(([jobName, job]) => {
+      if (!isRecord(job) || !Array.isArray(job.steps)) return []
+      return job.steps.flatMap((step) => {
+        if (!isRecord(step) || typeof step.uses !== 'string' || !step.uses.startsWith('pnpm/action-setup@')) return []
+        return [{ jobName, step }]
+      })
+    })
+
+    expect(setups.length).toBeGreaterThan(0)
+    for (const { jobName, step } of setups) {
+      expect(step, `${jobName} must not share pnpm/action-setup's default destination`).toMatchObject({
+        with: { dest: runnerPrivatePnpmDestination },
+      })
+    }
+  })
+})
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}