[rush] Relocate remaining pnpm settings to pnpm-workspace.yaml for pnpm 11

[iclanton]

Summary

Follow-up to #5880 that finishes moving pnpm settings out of the generated common/temp/package.json "pnpm" field (which pnpm 11 no longer reads) and into common/temp/pnpm-workspace.yaml.

Details

• Relocate the remaining pnpm settings for pnpm 11. ignoredOptionalDependencies, trustPolicy, trustPolicyExclude, and trustPolicyIgnoreAfterMinutes were still being written to the pnpm field of package.json, which pnpm 11 ignores — so they were silently dropped. They now go to pnpm-workspace.yaml (added to the PnpmWorkspaceFile schema), matching the other relocated settings. For pnpm < 11 they continue to be written to the pnpm field of package.json.
• Omit the pnpm field entirely for pnpm 11. Since every known setting is now relocated, the generated package.json no longer emits an empty pnpm: {} object under pnpm 11.
• PnpmWorkspaceFile.tryLoadAsync. Renamed loadAsync → tryLoadAsync, which now returns undefined (instead of throwing) when pnpm-workspace.yaml doesn't exist; the rush-pnpm patch-commit/patch-remove and approve-builds callers were updated accordingly.

neverBuiltDependencies/onlyBuiltDependencies are intentionally unchanged: pnpm 11 removed them entirely, and Rush already warns and translates them into allowBuilds in pnpm-workspace.yaml. The unsupportedPackageJsonSettings escape hatch is also unchanged, since it is explicitly scoped to package.json.

How it was tested

• heft test for rush-lib (707 tests passing), including new coverage that the four settings are written to pnpm-workspace.yaml and that no pnpm field is generated for pnpm 11.