[Bug]: DSH installer admits pnpm 12 but its frozen override configuration is rejected #6853

Problem

The DSH source installer accepts pnpm 9 or newer, including pnpm 12, then runs pnpm install --frozen-lockfile --ignore-scripts. With actual pnpm 12.10.1, this command rejects the plugin's existing override configuration. The same frozen dependency installation succeeds with the repository CI's pnpm 10.33.0, without changing the lockfile.

Relevant configuration on main dc9fdbb5186618ec2e797a9d7545e2fe524fee56:

• packages/dsh-loopx-plugin/install.sh admits any pnpm major >= 9.
• packages/dsh-loopx-plugin/package.json stores the existing @deepseek-ai/libreoffice-kit>fflate override under pnpm.overrides.
• The package lock records that override. The existing package-local pnpm-workspace.yaml contains build-denial settings, but does not project this override for the newer configuration reader.
• .github/workflows/dsh-plugin.yml qualifies pnpm 10.33.0.

Reproduction

From packages/dsh-loopx-plugin, with a compatible Node runtime:

npm exec --yes --package=pnpm@12.10.1 -- pnpm install --frozen-lockfile --ignore-scripts

Observed:

The "pnpm" field in package.json is no longer read by pnpm.
The following keys were ignored: "pnpm.overrides".
ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides"
configuration doesn't match the value found in the lockfile.

The exact command with --package=pnpm@10.33.0 succeeds. The installer admission and actual frozen dependency step are evidenced separately; this report does not claim a completed pnpm-12 DSH profile installation.

Expected outcome

Keep the override and frozen lock semantics intact. Either qualify a configuration projection compatible with the supported pnpm versions, or explicitly reject an unsupported version before dependency/profile effects and teach the supported route. Validate the declared pnpm range against the real source-installer dependency command, including the repository-pinned version and the newer version. Do not conceal the mismatch with an unrelated lock regeneration or removal of the override.

This was found while validating the separate Node prerequisite correction in #6851. It is not attributed to the older marketplace Git-fallback reports. No global package-manager upgrade, user profile change or publication was performed.