ci: migrate to allowBuilds and approve @parcel/watcher

onlyBuiltDependencies (and neverBuiltDependencies/ignoredBuiltDependencies/
ignoreDepScripts) were removed in pnpm v11, replaced by the allowBuilds
boolean map. pnpm auto-wrote a placeholder entry for @parcel/watcher during
local `pnpm approve-builds` that needed a real true/false value.

Without this, CI's frozen install hard-fails (strictDepBuilds defaults to
true in v11) on any build script pnpm hasn't seen approval for.

Author: odinr

pnpm-workspace.yaml

@@ -3,9 +3,6 @@ packages:
   - cookbooks/*
   - vue-press
 
-onlyBuiltDependencies:
-  - keytar
-
 # @changesets/cli and @changesets/write were published <24h ago (still inside pnpm 11's
 # default minimumReleaseAge window) but are already-vetted devDependency-only build tooling
 # from the changesets v2->v3 migration (PR #5337) — exempt them so installs aren't blocked.
@@ -50,7 +47,7 @@ overrides:
 
 allowBuilds:
   '@azure/msal-node-extensions': true
-  '@parcel/watcher': set this to true or false
+  '@parcel/watcher': true
   '@vscode/vsce-sign': true
   agent-browser: true
   esbuild: true