feat: add pnpm-install as a shared composite action

Lifts ptpa_pl's local .gitea/actions/pnpm-install into this repo, parametrised
enough for repositories we have not met yet: working-directory, install args,
pnpm version and an opt-in store cache.

Cache is off by default. ADR-0014 pins actions/cache to major 3 and no workflow
on this instance has exercised the cache server yet - a shared action that a
dozen jobs hang off is the wrong place to premiere that dependency.

Two traps found while testing against ptpa_pl's lockfile in node:24-bookworm-slim,
both avoided by pinning the store instead of reading `pnpm store path`:
that command defaults to <workspace>/.pnpm-store, inside the working tree where a
committing job could sweep it up, and it exits 0 while printing its error to
stdout, which would have fed actions/cache a garbage path silently.

The version input also carries COREPACK_ENABLE_PROJECT_SPEC=0, without which a
packageManager field outranks `corepack prepare --activate` and the input would
do nothing at all - no effect, no error.

README.md

@@ -9,6 +9,7 @@ przy pobieraniu akcji, patrz „Dostęp" niżej.
 
 | Akcja | Do czego |
 | --- | --- |
+| [`pnpm-install`](pnpm-install/) | corepack + `pnpm install` z lockfile'a, opcjonalny cache store'a |
 | [`resolve-buildx-cache`](resolve-buildx-cache/) | `DOCKER_CACHE_*` z runnera → `driver-opts` i refy cache'a dla buildx |
 
 ## Jak używać
@@ -47,6 +48,9 @@ Ustawienia nie ma w REST API — trzeba wyklikać.
 
 Aktualnie nadane: `cierzniak-it`.
 
+Do nadania przy najbliższej migracji: **`ptpa`** (`website`) — pierwszy konsument
+`pnpm-install`, dziś bez dostępu.
+
 Kandydaci do dodania, gdy akcja pojedzie szerzej (repo z buildxem w CI):
 `leczenieran` (`wizytowka`, `elektroniczna-dokumentacja-medyczna`),
 `welding-technology-review` (`witryna-internetowa`), `ekoinbud` (`production-system`).