…ity)

- Replace @pnpm/installing.modules-yaml imports in e2e tests with a local
  readModulesManifest that parses .modules.yaml directly. The pnpm v11
  package is ESM and fails with 'Cannot require() ES Module ... because
  it is not yet fully loaded' when Mocha loads multiple test files in
  parallel.
- Drop @pnpm/network.fetch from npm-ci-registry.ts and use the built-in
  global fetch with a local retry loop.

The pnpm v11 packages are ESM, and the `teambit.harmony/envs/core-aspect-env` Mocha
runner in the build capsule fails with "Cannot use import statement outside a module"
when the spec files transitively `require('@pnpm/deps.path' | '@pnpm/lockfile.fs' | '@pnpm/error')`.

Running `bit test scopes/dependencies/pnpm` locally still passes (10/10), so the
coverage isn't lost for local development — just disabled in CI until the capsule
test env supports require() of ESM.

Pnpm v11 (#11189) restricts .npmrc to auth + registry settings only;
hoist-pattern now lives in pnpm-workspace.yaml, so the legacy test
premise no longer applies.

pnpm v11 removed the neverBuiltDependencies install option entirely. Bit's
public API still exposes it, so translate it into the new allowBuilds map
with values set to false. Also ensures dangerouslyAllowAllScripts respects
the blocklist.

pnpm v11's createAllowBuildFunction short-circuits when
dangerouslyAllowAllBuilds is true and ignores allowBuilds entries entirely.
To keep the 'allow all except X' pattern working, skip the flag when a
deny list is present and emit allowBuilds with just the deny entries.

The package is ESM in pnpm v11; loading it through a top-level CJS require()
in the build capsule crashes with 'Unexpected token export'. Dynamic import
bypasses Node's require-ESM machinery and uses the proper ESM loader.

Using new Function('return import(p)') prevents bit's compiler from
rewriting dynamic import() back to require(), so @pnpm/releasing.commands
truly loads through Node's ESM loader rather than require-ESM.

…lude

Exclude @babel/plugin-transform-dynamic-import in both the root babel
config and the aspect env babel config so Babel preserves native
import() in compiled CJS output. This lets packer.ts call
import('@pnpm/releasing.commands') directly instead of going through
the new Function('return import(p)') escape hatch.

Now that babel preserves native import() in CJS output, the inlined
readModulesManifest in three e2e tests and the hand-rolled
fetchWithRetry in npm-ci-registry can be dropped in favor of
await import('@pnpm/installing.modules-yaml') / '@pnpm/network.fetch'
inside the call sites. Type-only imports of Modules stay static
since they're stripped at compile time.

The legacy link is only needed for external repos still importing
`@teambit/legacy`. Since v11 no longer guarantees the package is
installed locally (pnpm-lock no longer carries it), throwing on
require.resolve aborts every install/link in fresh CI workspaces.
Swallow the resolution failure so linking continues.

Three pre-existing dead statements (a `throw` after `return`/`throw` in
each file) only started failing once the post-install oxlint bump from
1.12 to 1.62 enabled stricter `no-unreachable` detection.

Pare back the comments added during the v11 work to keep only the
non-obvious "why" notes — drop what-comments, JSDoc/inline filler in
the auth-config helper, the duplicate ESM justification on packer.ts,
and the empty-catch placeholder in dependency-linker.ts.

The premise — workspace .npmrc options propagating into capsule installs —
no longer applies under pnpm v11, and bridging this through pnpm-workspace.yaml
isn't worth supporting. Drop the test and the pnpmWorkspaceConfig helper hook
added for the rewrite attempt.

…best-effort"

This reverts the relevant change from e6ca4a7 and the comment touch-up
in b5a5332. The original CI failure was diagnosed before later fixes
landed and was not reproduced afterwards, so swallowing the error here
masked symptoms without addressing the root cause.

…ompat"

This reverts the spec deletions from 9fa93e8. Node 22's native
require(esm) lets the capsule's mocha runner load the transitive
ESM-only @pnpm/* deps without any wrapping; bit test runs all
12 specs successfully.