* chore: also bump Node.js, pnpm, and pacquet in update-lockfile workflow
* chore: address PR review feedback on update-lockfile workflow
- Base the update branch on an explicitly fetched origin/main
- Don't persist the write token during install; push with explicit URL
- Detect open PRs via gh --json instead of grepping table output
- Add a concurrency guard to serialize dispatch + scheduled runs