pnpm gotchas: lockfile conflicts, overrides, workspace cascade

pnpm gotchas: (1) Lock file conflicts: never manually resolve — git checkout --theirs pnpm-lock.yaml then pnpm install to regenerate. git stash pop after merge can re-conflict; drop the stash and re-run instead. (2) Overrides: >= crosses major versions — use ^ to stay in-major. Version-range selectors don't reliably force re-resolution of compatible transitive deps; use blanket overrides when all consumers are on same major. (3) Overrides go stale on tree changes — audit with pnpm why and remove orphans. (4) Root pnpm.overrides does NOT cascade into workspace sub-projects with their own lockfile (e.g. docs/). Concrete case: root postcss: ^8.5.10 resolved to 8.5.15 (vulnerable, <= 8.5.17, GHSA-r28c-9q8g-f849) and left docs/ on 8.5.15 too. Fix required adding postcss: ^8.5.18 to BOTH root and docs/package.json (resolves 8.5.24). When fixing a transitive vuln, check EVERY workspace package.json + lockfile, not just root.