The overrides that pin the atproto alpha packages, and the dependencies allowed to run build scripts, live in pnpm-workspace.yaml rather than the "pnpm" field of package.json, which pnpm 11 no longer reads and warns about on every command. onlyBuiltDependencies becomes allowBuilds, which pnpm 10.33 also reads and turns back into the same allowlist, so the pinned pnpm and a global pnpm 11 install the same tree, and the frozen lockfile is unchanged. CLAUDE.md and the foundation spec say where the overrides now live.