Add pnpm-lock.yaml for dummy app

The dummy app's JS dependencies were missing a lockfile, which meant
dependency versions could vary between installs. This lockfile ensures
reproducible builds for local development and CI.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: justin808