[FE-3214] chore: migrate from npm to pnpm with supply chain hardening

[Kabidoye-17]

Why?

This repo was surfaced in a follow-up audit as part of the org-wide effort to bring active npm repos onto a supply-chain-hardened footing (per-package script gating, install cooldown, pnpm's stricter dependency graph). Migrating to pnpm 10 aligns Intercom-OpenAPI with the target config already applied across the sibling repos in FE-3214.

How?

pnpm import was used to convert package-lock.json to pnpm-lock.yaml verbatim, preserving every resolved version so no transitive dependency drift shipped alongside the tooling swap. Supply-chain settings (minimumReleaseAge: 10080, trustPolicy: no-downgrade) live in pnpm-workspace.yaml; a preinstall guard enforces pnpm locally and no-ops in CI; the es5-ext cosmetic postinstall is silenced via pnpm.ignoredBuiltDependencies. Disabled workflows under .github/workflows-disabled/ were updated so they continue to work if re-enabled — the new pnpm/action-setup refs are SHA-pinned. Pre-existing GHA hardening gaps (unpinned actions/checkout, missing top-level permissions: blocks) were left out of scope; whoever re-enables any workflow should run the security-review skill end-to-end first.

Follow-up commit — fern-api is pinned to 5.65.3 in docs and workflows. pnpm add -g fern-api (unpinned) fails through Intercom's registry proxy because the proxy serves the fern-api manifest without a dist-tags block, and pnpm has no fallback resolver for a missing latest tag. Upstream issues, both open:

• pnpm/pnpm#5564
• pnpm/pnpm#9944

When those are fixed (or the proxy is fixed to include dist-tags), the pin can be dropped.

_{Generated with Claude Code}

[Kabidoye-17]

Local Verification — no regressions

Same fern flow run on both sides. The same 3 pre-existing spec errors and 295 warnings appear on main and on this branch — no new errors introduced by the migration.

Master (npm install)

rm -rf node_modules && npm install — 550 packages in 6s; 6 deprecation warnings; 12 vulnerabilities (4 moderate, 8 high) reported by npm audit.

npm install -g fern-api → fern check → fern generate --preview --group ts-sdk — 3 errors, 295 warnings.

This branch (pnpm install)

rm -rf node_modules && pnpm install — 522 packages in 3.3s; preinstall guard runs and exits 0. The ${GITHUB_TOKEN} .npmrc warning is pre-existing (harmless — no @intercom/* runtime deps consume it).

fern check — 3 errors, 295 warnings (identical to master).

fern generate --preview --group ts-sdk — 3 errors, 295 warnings (identical to master).

Errors — identical on both sides

File	Error
preview/conversationsAttributes.yml	CreateConversationAttributeOptionRequest already declared in preview/__package__.yml
preview/articles.yml	PublishArticleDraftRequest already declared in preview/__package__.yml
preview/articles.yml	UpdateArticleRequestBody is not defined

Pre-existing spec issues, unrelated to the migration.

~ Automated via Claude