feat: pnpm

[joshuarli]

https://linear.app/getsentry/issue/DI-1012/devenv-install-pnpm

this adds pnpm support and drops yarn v1! after this, as noted in the updated readme the new sync.py for installing node + pnpm is this:

from devenv import constants
from devenv.lib import config, node, proc

def main(context: dict[str, str]) -> int:
    reporoot = context["reporoot"]
    cfg = config.get_repo(reporoot)

    node.install(
        cfg["node"]["version"],
        cfg["node"][constants.SYSTEM_MACHINE],
        cfg["node"][f"{constants.SYSTEM_MACHINE}_sha256"],
        reporoot,
    )

    node.install_pnpm(reporoot)

    print("installing node dependencies...")
    proc.run(
        (
            f"{reporoot}/.devenv/bin/pnpm",
            "install",
            "--frozen-lockfile",
            "--reporter=append-only",
        ),
    )

    return 0

[sentry]

Bug: Direct access to package_json["packageManager"] without existence check can cause KeyError.
_{Severity: CRITICAL | Confidence: 1.00}

🔍 Detailed Analysis

If install_pnpm() is called on a repository without a packageManager field in its package.json, the code will raise an unhandled KeyError when attempting to access package_json["packageManager"]. This occurs because the field is optional according to npm documentation, and the current implementation directly accesses it without checking for its existence. This will crash the setup process.

💡 Suggested Fix

Add a check for the existence of the packageManager key in package_json before accessing it. Provide a default value or raise a more informative error if missing.

🤖 Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: devenv/lib/node.py#L91-L93

Potential issue: If `install_pnpm()` is called on a repository without a
`packageManager` field in its `package.json`, the code will raise an unhandled
`KeyError` when attempting to access `package_json["packageManager"]`. This occurs
because the field is optional according to npm documentation, and the current
implementation directly accesses it without checking for its existence. This will crash
the setup process.

_{Did we get this right? 👍 / 👎 to inform future reviews.}