PNPM 12 installation needs Dockerfile update (use `npm install -g --allow-scripts=pnpm`)

Building the ui image from scratch, Tilt was reporting this:

resolve image config for docker-image://docker.io/docker/dockerfile:1 [done: 390ms]
docker-image://docker.io/docker/dockerfile:1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 [cached]
[builder 1/9] FROM docker.io/library/node:26@sha256:e961046fec20896e8904f2b4a8b4c7e5ca91826d84d8d33d83dbaa61f942069e 64.18MB / 64.18MB [done: 5.606s]
[background] read source files 1.83MB [done: 217ms]
[builder 2/9] RUN npm install -g pnpm@12.3.4
  → 
  → added 2 packages in 3s
  → npm warn install-scripts 1 package has install scripts not yet covered by allowScripts:
  → npm warn install-scripts   pnpm@12.3.4 (preinstall: node install.js; postinstall: node install.js)
  → npm warn install-scripts
  → npm warn install-scripts Run `npm install -g --allow-scripts=pnpm` to allow these scripts once, or `npm config set allow-scripts=pnpm --location=user` to allow them for all global installs.
  → npm notice
  → npm notice New major version of npm available! 11.19.1 -> 12.0.2
  → npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.0.2
  → npm notice To update run: npm install -g npm@12.0.2
  → npm notice
[builder 2/9] RUN npm install -g pnpm@12.3.4 [done: 3.878s]

As the message suggests, we should add --allow-scripts=pnpm to that NPM command. If pnpm's own install script is ever compromised, then the pnpm code itself would also have been compromised so this doesn't increase any supply-chain risk.