fix(sv-utils): detect pnpm version from the target project, not the invoker cwd

[cpruijsen]

Closes #1306

Description

pnpm.allowBuilds now takes { cwd, pnpmVersion } and detects the pnpm major from the target project, not the invoker cwd. sv create / sv add (addPnpmAllowBuilds) and the Cloudflare adapter pass the target path. When cwd is omitted, detection runs in os.tmpdir() so the invoker's pin is not inherited.

Previously, pnpm.allowBuilds chose between allowBuilds (pnpm 11+) and onlyBuiltDependencies (pnpm 10) by running pnpm --version with no cwd, so Node used the invoker's working directory. From this repo (packageManager: pnpm@10.33.4), sv create ../test --install pnpm wrote the legacy key even when the new project would run pnpm 11.

pnpm --version follows package.json#packageManager / devEngines.packageManager by walking up from cwd. This repo reports 10.33.4; os.tmpdir() reports 11.26.0; a directory pinned to pnpm@11.0.0 reports 11.0.0 (same numbers under pnpm exec).

Decision: pass target { cwd } from first-party callers, accept { pnpmVersion } for explicit writes, default omitted cwd to os.tmpdir().
Alternative: only cwd: os.tmpdir() inside detectPnpmMajor (the one-line diff in the issue).
Why: tmpdir-only does not fix pnx sv add in a project whose pin differs from global pnpm (as the issue notes). Can drop the tmpdir default and/or { pnpmVersion } for a smaller public API; first-party { cwd } alone fixes sv create and sv add.

Checklist

• Update snapshots (if applicable): api-surface.md regenerated; CLI create snapshots unchanged (in-repo test apps still see this repo's pnpm 10 pin)
• Add a changeset (if applicable)
• Allow maintainers to edit this PR
• I care about what I'm doing, no matter the tool I use (Notepad, Sublime, VSCode, AI...)

[pkg-svelte-dev]

Install the latest version of sv from a01d829:

pnx https://pkg.svelte.dev/sv/c/a01d82993a4f745b0b53aecc94de6aa0d6fe9d75 create

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/cli/pr/1320

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: a01d829

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@sveltejs/sv-utils	Patch
sv	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR