Temporary: jco toolchain pinned to lann/jco all-fixes until the fixes ship upstream

[lann]

The three JS package trees consume @bytecodealliance/jco-transpile as a
rev-pinned git dependency of lann/jco (the all-fixes branch), built at
install time in the pnpm store. just jco-pin-check holds the six pin
sites (three package.json specs, three pnpm-workspace.yaml build
allowlists) to one rev; the bump procedure is in AGENTS.md. This replaced
the local fixes tracked in #3 (post-transpile string-lowering patch) and
#16 (deferred-connections wrapper), and unblocked the #18 Chromium leg.

Load-bearing subset, as proven by this repository's gates:

• fix/flat-string-lower-length — the echo/text-unicode conformance
  case fails on both jco legs without it;
• feat/no-eager-subtask-return — just wpt::smoke hangs after the
  first receive without the flag (componentize-js guests only);
• at least one of the JSPI/async set (fix/jspi-current-task-register,
  fix/sync-lowered-async-promise, fix/async-start-call-param-count,
  the async-import handshake hardening, fix/subtask-cancel) unblocks
  the Chromium round-trip leg (Chromium roundtrip leg: jco driver delivers subtask events to recycled waitable slots (guest exits mid-suite) #18) — not bisected to a single fix.

Exit condition (roughly in order):

• file upstream PRs from the per-fix branches on lann/jco (none
  open today; several earlier fixes from the same fork are already
  merged upstream)
• no-eager-subtask-return: upstream accepts the compat option, or
  componentize-js implements the returned-immediately case for
  async-lowered imports (then drop the flag from the three parity
  transpile scripts instead)
• a registry @bytecodealliance/jco-transpile release contains the
  load-bearing set
• switch the three package.json specs to the registry semver, drop
  the three onlyBuiltDependencies entries, reinstall, and retire
  just jco-pin-check

When testing a candidate upstream release: just wpt::smoke (fast
bisector), just conformance-ct, and just wpt::parity-chromium (once
#26 unblocks its ratchet) are the acceptance gates.

Notes:

• The pnpm migration is severable: registry deps work under pnpm, so the
  exit does not require reverting to npm (a separate decision if wanted).
• CI: a cold pnpm store rebuilds the git dependency (a cargo release
  build); the store cache's restore-keys bound that to pin bumps and
  cache evictions. If cold-build time ever becomes a problem, the
  fallback is the repository's prebuilt-toolchain pattern (a release
  tarball with a pinned digest, as for componentize-js), trading direct
  branch resolution for zero install-time builds.