ci: Add manual pnpm sticky disk seed (no-changelog) (#39619)

.github/WORKFLOWS.md

@@ -710,6 +710,14 @@ while the build reports a successful commit. Every job therefore shares the
 `n8n-io/n8n` key, which is the only disk that actually retains layers. Revisit
 once new-disk retention works.
 
+`ci-seed-pnpm-sticky-disk.yml` fills the pilot pnpm store on a separate sticky
+disk. Dispatch it manually on `master` before rerunning the container pilot PR.
+The workflow mounts `/pnpm-sticky-store` under key
+`n8n-io-n8n-pnpm-pilot-linux-amd64-v11`, then installs the lockfile without
+lifecycle scripts. Blacksmith branch protection permits this default-branch
+dispatch to commit the store. Pull request jobs can read it, but cannot commit
+their changes. This workflow does not run during regular CI.
+
 ### run-workflow-script
 
 ```yaml

.github/workflows/ci-seed-pnpm-sticky-disk.yml

@@ -0,0 +1,77 @@
+name: 'CI: Seed pnpm Sticky Disk'
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-seed-pnpm-sticky-disk
+  cancel-in-progress: false
+
+jobs:
+  seed:
+    name: Seed pnpm store
+    if: github.repository == 'n8n-io/n8n' && github.ref == 'refs/heads/master'
+    runs-on: blacksmith-4vcpu-ubuntu-2204
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      packages: read
+    container:
+      image: ghcr.io/n8n-io/ci-toolchain:node26.5.1-pnpm12.4.2-pw1.62.1-sc1.5.20-v2
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ github.token }}
+      options: --privileged
+      env:
+        VM_ID: ${{ env.VM_ID }}
+        GITHUB_REPO_NAME: ${{ env.GITHUB_REPO_NAME }}
+        BLACKSMITH_STICKYDISK_TOKEN: ${{ env.BLACKSMITH_STICKYDISK_TOKEN }}
+        BLACKSMITH_INSTALLATION_MODEL_ID: ${{ env.BLACKSMITH_INSTALLATION_MODEL_ID }}
+        BLACKSMITH_REGION: ${{ env.BLACKSMITH_REGION }}
+    steps:
+      - name: Trust checkout directory
+        run: |
+          {
+            echo 'GIT_CONFIG_COUNT=1'
+            echo 'GIT_CONFIG_KEY_0=safe.directory'
+            echo "GIT_CONFIG_VALUE_0=$GITHUB_WORKSPACE"
+          } >> "$GITHUB_ENV"
+
+      - uses: useblacksmith/checkout@bcec731f1eb1367240608d1c889a75b96db6ec53 # v1.5.0
+
+      - name: Mount pnpm store
+        uses: useblacksmith/stickydisk@94697d49e77d0dd78b77deb85ad3de63a28b4b8a # v1
+        with:
+          key: n8n-io-n8n-pnpm-pilot-linux-amd64-v11
+          path: /pnpm-sticky-store
+          commit: on-change
+
+      - name: Verify mounted store and pinned tools
+        run: |
+          mountpoint -q /pnpm-sticky-store
+          test "$(node --version)" = v26.5.1
+          test "$(pnpm --version)" = 12.4.2
+          test "$(pnpm --store-dir /pnpm-sticky-store store path --silent)" = /pnpm-sticky-store/v11
+          du -sh /pnpm-sticky-store
+
+      - name: Activate SafeChain
+        run: |
+          mkdir -p "$HOME/.safe-chain/bin"
+          cp "$GITHUB_WORKSPACE/.github/actions/setup-nodejs/safe-chain.config.json" "$HOME/.safe-chain/config.json"
+          cp /opt/ci-toolchain/safe-chain "$HOME/.safe-chain/bin/safe-chain"
+          "$HOME/.safe-chain/bin/safe-chain" setup-ci
+
+      - name: Verify SafeChain and fill store
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          pnpm safe-chain-verify
+          pnpm --store-dir /pnpm-sticky-store install --frozen-lockfile --ignore-scripts --trust-lockfile --reporter=append-only
+
+      - name: Report seeded store
+        run: |
+          du -sh /pnpm-sticky-store
+          echo "Seeded pnpm store: $(du -sh /pnpm-sticky-store)" >> "$GITHUB_STEP_SUMMARY"