fix: close immutable promotion trust gaps

.gitea/workflows/quality-gates.yml

@@ -137,6 +137,7 @@ jobs:
           mkdir -p .release
           tar --sort=name --mtime="@0" --owner=0 --group=0 --numeric-owner -czf ".release/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz" \
             dist \
+            pnpm-lock.yaml \
             artifacts/performance/bundle.json \
             artifacts/quality/vite-module-inventory.json \
             artifacts/release/build-manifest.json \
@@ -167,6 +168,7 @@ jobs:
     timeout-minutes: 45
     env:
       CANDIDATE_DIST_SHA256: ${{ needs.immutable_build.outputs.dist_sha256 }}
+      CANDIDATE_LOCKFILE_PATH: pnpm-lock.yaml
       VULNERABILITY_PROVIDER_COMMAND: ${{ vars.VULNERABILITY_PROVIDER_COMMAND }}
       VULNERABILITY_REPORT_PATH: provider-evidence/vulnerability-report.json
     steps:
@@ -197,6 +199,7 @@ jobs:
     timeout-minutes: 45
     env:
       CANDIDATE_DIST_SHA256: ${{ needs.immutable_build.outputs.dist_sha256 }}
+      CANDIDATE_LOCKFILE_PATH: pnpm-lock.yaml
       PROVENANCE_PROVIDER_COMMAND: ${{ vars.PROVENANCE_PROVIDER_COMMAND }}
       PROVENANCE_ATTESTATION_PATH: provider-evidence/provenance-attestation.json
     steps: