fix(build): pnpm-install --reporter=silent hides the reason CI failed

[EricAndrechek]

Summary

make verify's hidden pnpm-install target runs with --reporter=silent. For at least one whole class of failure — a lockfile that violates the workspace supply-chain policy — pnpm then exits non-zero having printed nothing. CI reports five red jobs whose only stated cause is:

make[1]: *** [Makefile:713: pnpm-install] Error 1

The comment above the target claims the opposite:

# ... --reporter=silent drops the
# "Scope / Already up to date / Done in Xms" chatter so it doesn't clutter the
# verify checklist; fatal errors (e.g. a lockfile mismatch) still print.
.PHONY: pnpm-install
pnpm-install:
	@$(PNPM) install --frozen-lockfile --reporter=silent

Makefile:706-713. "fatal errors ... still print" is false for this class.

Reproduction

Against a lockfile with a minimumReleaseAge violation:

$ pnpm install --frozen-lockfile --reporter=silent ; echo "exit=$?"
exit=1          # zero bytes of output

$ pnpm install --frozen-lockfile ; echo "exit=$?"
✗ Lockfile failed supply-chain policy check (1126 entries in 2.1s)
[ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 21 lockfile entries failed verification:
  @clack/core@1.5.0 was published at 2026-09-07T20:12:19.000Z, within the minimumReleaseAge cutoff
  ...
exit=1

Impact, observed

Dependabot PR #571 failed Lint, Docs build, Unit tests, E2E tests and Coverage — all five from this one step. Grepping the complete job log for ERR_PNPM|supply-chain|minimumReleaseAge|Verifying returns nothing (run 34292840574). The actual cause had to be reconstructed by checking the branch out and re-running the install by hand.

This is not a one-off: every Dependabot npm PR is a candidate, because Dependabot resolves without reading minimumReleaseAge (#441). The next one fails exactly as opaquely.

Suggested fix

Keep the quiet happy path, restore output on failure — e.g. capture and replay on non-zero:

pnpm-install:
	@out=$$($(PNPM) install --frozen-lockfile --reporter=silent 2>&1) || { printf '%s\n' "$$out"; exit 1; }

or simply drop --reporter=silent for this target and accept three lines of chatter. Either way the comment at Makefile:706-710 needs correcting, since it currently documents behavior the flag does not deliver.

Related

• fix(deps): Dependabot lockfiles bypass the minimumReleaseAge cooldown #441 — Dependabot lockfiles bypass the minimumReleaseAge cooldown (the failure class this hides).
• deps: bump astro from 7.1.6 to 7.2.8 #571 — the PR where it cost real diagnosis time.

Found during pre-push review of the astro bump that replaces #571.