pnpm update drops existing overrides metadata and reverts parent-scoped dependency resolution

### Existing issue search

Searched existing pnpm/overrides/lockfile reports. #15073 concerns adding unrelated audit overrides; this report concerns dropping existing manifest overrides and changing their resolved dependency.

### Package ecosystem and environment

GitHub-native Dependabot, npm ecosystem, `/astro-site`; pnpm lockfile v9. Native verification: pnpm 10.33.0, Node.js 22.22.3, Linux. The hosted updater's exact pnpm version and dependabot-core revision are not available in the public PR/check artifacts; I am not assuming they match the local version.

### Public reproduction artifacts

- [Original bot PR #564](https://github.com/williamzujkowski/williamzujkowski.github.io/pull/564), original bot commit `d0160c50bdd2ff98067db65088a7780c3656104d`.
- [Manifest before update](https://github.com/williamzujkowski/williamzujkowski.github.io/blob/2ba4e8afa6213d9c7e71c6a6794c68e49827e16d/astro-site/package.json), including `pnpm.overrides` and `"satori>fflate": "0.7.5"`.
- [Lockfile before update](https://github.com/williamzujkowski/williamzujkowski.github.io/blob/2ba4e8afa6213d9c7e71c6a6794c68e49827e16d/astro-site/pnpm-lock.yaml).
- [Bot-generated lockfile](https://github.com/williamzujkowski/williamzujkowski.github.io/blob/d0160c50bdd2ff98067db65088a7780c3656104d/astro-site/pnpm-lock.yaml).
- [Dependabot configuration](https://github.com/williamzujkowski/williamzujkowski.github.io/blob/2ba4e8afa6213d9c7e71c6a6794c68e49827e16d/.github/dependabot.yml).
- [Failing CI check](https://github.com/williamzujkowski/williamzujkowski.github.io/actions/runs/34259053152/job/102172162087).

The grouped update bumps Astro 7.2.10 → 7.3.1, ESLint 10.9.1 → 10.10.0, and Playwright 1.62.1 → 1.63.0. The manifest's overrides are unchanged.

### Expected versus actual

Expected: preserve existing `pnpm.overrides` in both the dependency resolution and lockfile metadata, so a frozen install succeeds.

Actual: the generated lockfile removes the complete top-level `overrides:` mapping and changes `satori@0.33.4`'s dependency from `fflate: 0.7.5` to `fflate: 0.7.3`, adding a 0.7.3 package/snapshot entry. This is not just missing metadata. A local frozen install fails:

```text
ERR_PNPM_LOCKFILE_CONFIG_MISMATCH Cannot proceed with the frozen installation. The current "overrides" configuration doesn't match the value found in the lockfile
```

### Native package manager behavior

These steps reproduce the failure and repair the exact public bot artifact (they do not reproduce the hosted updater itself):

```sh
git clone https://github.com/williamzujkowski/williamzujkowski.github.io.git
cd williamzujkowski.github.io
git checkout d0160c50bdd2ff98067db65088a7780c3656104d
cd astro-site
# pnpm 10.33.0
pnpm install --frozen-lockfile # fails as above
pnpm install --lockfile-only
pnpm install --frozen-lockfile # succeeds
```

Native regeneration restores the overrides header, removes the `fflate@0.7.3` entries, restores `satori` → `fflate@0.7.5`, and reapplies six override-related peer range metadata entries. It does not change the three requested direct dependency updates. The repaired tree builds and passes type checking, lint, design audits and 18 unit tests.

### Scope and remaining uncertainty

Earlier occurrences in the same repository were tracked in [local issue #540](https://github.com/williamzujkowski/williamzujkowski.github.io/issues/540). The previous working hypothesis was serialization-only, but the new parent-scoped `satori>fflate` override makes the resolution regression directly visible. I have not reduced this to a smaller manifest or identified the responsible hosted updater code path. The pinned original bot commit above remains available after the per-PR manual repair.