Adopt pnpm as the de facto package manager for the google-cloud-node repository.

## I think we should keep these lockfiles (except maybe yarn)

I think consolidating around a package manager is a bit more complicated than deleting these lockfiles.

At minimum, I think we NEED to have lock files for NPM (to cover automation and our customers) and PNPM (to cover our automation).

Lockfiles are most useful as a mitigation against supply chain attacks (we are going to be adding them everywhere in the near future). Deleting them exposes us to more risk. Simply running `npm install` is a major security risk these days UNLESS our versions are strictly defined in a lockfile. For example:
* https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem

## Consolidation is mostly a CI/Automation problem

To consolidate around a single package manager, the key challenge is actually in our automation (GitHub Actions, GCB, Docker Containers, BazelBot, etc.). These automations use a mixture of PNPM and NPM. Note, that modern supply chain attacks are specifically designed to compromise CI (i.e. with Docker escape mechanisms). As a result, we probably need to keep a NPM and PNPM lock around.

Here are a few usage examples:
* BazelBot implictly uses the PNPM lockfile as its source of truth for versions: https://github.com/googleapis/google-cloud-node/blob/main/core/generator/gapic-generator-typescript/WORKSPACE#L47
* Our test runner uses PNPM to install and execute project scripts: https://github.com/googleapis/google-cloud-node/blob/main/ci/run_single_test.sh#L44
* Our interdependent test scripts use NPM directly: https://github.com/googleapis/google-cloud-node/blob/main/ci/run_interdependent_tests.sh#L166
* Our Docker containers use NPM to install PNPM: https://github.com/googleapis/google-cloud-node/blob/main/ci/Dockerfile#L37
* Many of our Google Cloud Build runners use NPM directly: https://github.com/googleapis/google-cloud-node/blob/main/handwritten/bigtable/cloudbuild.yaml#L8

_Originally posted by @pearigee in https://github.com/googleapis/google-cloud-node/issues/8365#issuecomment-4556787174_

Inizia tracciando l’utilizzo dei package manager in core/generator/gapic-generator-typescript/WORKSPACE, ci/run_single_test.sh, ci/run_interdependent_tests.sh, ci/Dockerfile e handwritten/bigtable/cloudbuild.yaml. Fai un inventario di come ogni automazione utilizza npm o pnpm e di come vengono utilizzati entrambi i lockfile. Per considerare il lavoro completato sono necessarie una policy concordata sui package manager e modifiche coerenti in tutti questi punti di ingresso dell’automazione, ma l’issue non definisce criteri di accettazione precisi.

Scritto dal modello di indicizzazione a partire dal testo della issue.