Зафиксировать pnpm packageManager для frontend и усилить frozen-lockfile policy

apps/frontend/package.json

@@ -4,6 +4,7 @@
   "private": true,
   "description": "HY2XS admin",
   "author": "HY2XS",
+  "packageManager": "pnpm@9.15.9",
   "scripts": {
 	"dev": "vite serve --mode development",
 	"build:prod": "vite build --mode production && vue-tsc --noEmit",

tools/build/README.md

@@ -155,6 +155,22 @@ bun install --frozen-lockfile
 
 If this command fails, fix and commit the lockfile in source control. Do not remove `--frozen-lockfile`.
 
+## Frontend lockfile discipline
+
+Do not regenerate frontend lock data during routine production builds.
+
+For frontend package management:
+
+- [`apps/frontend/package.json`](../../apps/frontend/package.json) declares `"packageManager": "pnpm@9.15.9"`;
+- builder uses pinned pnpm `9.15.9` from [`PNPM_REQUIRED`](lib/deps.sh);
+- production frontend install path is always:
+
+```bash
+pnpm install --frozen-lockfile
+```
+
+If frozen install fails, update dependencies intentionally in source control and commit lockfile changes. Do not remove `--frozen-lockfile` from build flow.
+
 ## Полезные переменные
 
 - `PACKAGE_VERSION=0.1.6`