CI: scope pnpm install per job with --filter to skip unneeded packages

## Context

`.github/actions/node-setup/action.yml` runs an unfiltered `pnpm install --frozen-lockfile` for every job in every workflow that uses it (`ci.yml`, `pr.yml`, `next.yml`, `pre-release.yml`, `generate-docs.yml`, `index-docs.yml`, `copilot-setup-steps.yml`). Since it's a monorepo, this installs the entire workspace regardless of what a given job actually touches.

Concretely: `packages/cli-plugins/copilot` depends on `@github/copilot-sdk` and `agent-browser` for its `app eval` command. `@github/copilot-sdk`'s optional native binary (`@github/copilot-darwin-arm64` locally, linux-x64 equivalent on CI) alone is ~326MB. Jobs like `pr.yml`'s `code-quality` (lint/build) never touch the copilot plugin but still pay to install it on every run.

## Proposal

Add an optional `filter` input to `node-setup/action.yml` that gets passed through to `pnpm install --frozen-lockfile --filter `, and set it per-workflow/per-job based on what that job actually needs (e.g. exclude `packages/cli-plugins/copilot` from jobs that only build/lint/test the rest of the workspace).

## Risks / open questions

- Need to verify each job's actual transitive needs before narrowing the filter — a wrong exclusion could silently skip installing something a job needs.
- `ci.yml`'s `release-pkg` job publishes the whole monorepo, so it likely needs to stay unfiltered.
- Worth checking whether `turbo`'s own affected-package detection already covers some of this at the task level, separate from the install step.

## Related

Follow-up from investigating CI cache size — see `.github/actions/node-setup/action.yml` (cache-only-save-on-main change) and the `agent-browser`/`@github/copilot-sdk` dependency scoping.

Start with .github/actions/node-setup/action.yml and trace its uses in ci.yml, pr.yml, next.yml, pre-release.yml, generate-docs.yml, index-docs.yml, and copilot-setup-steps.yml. Verify each job’s transitive package needs before adding filters, and keep ci.yml’s release-pkg job unfiltered if it publishes the whole monorepo. Done means jobs install only needed workspace packages without breaking their tasks, while turbo’s affected-package behavior is checked separately.

Written by the indexing model from the issue text.