chore(example): migrate subdir to pnpm 11 and modernize toolchain

[cernadasjuan]

Summary

• Aligns example/ with the root SDK's pnpm 11 supply-chain setup: minimumReleaseAge: 14d, engineStrict, trustPolicy: no-downgrade, blockExoticSubdeps, exact-version pins via savePrefix: "", and explicit allowBuilds (no install scripts pulled in).
• Drops package-lock.json, adds pnpm-lock.yaml + pnpm-workspace.yaml, blocks future npm/yarn lockfiles via .gitignore. Bumps packageManager to pnpm@11.1.3, adds engines (node ≥24, pnpm ≥11) and devEngines, wires preinstall: pnpm audit && pnpm audit signatures.
• Modernizes tsconfig.json to the official TS wiki recommendation for Node 24 (target/lib: ES2024, module: node20, moduleResolution: node16), turns on skipLibCheck to absorb noise from the symlinked SDK source, and aligns strict: false with the root SDK to avoid fighting types across the link:.. boundary.
• Bumps deps to the newest versions allowed by the workspace rules: dotenv 17.4.2, moment 2.30.1, @types/node 24.12.4, typescript 5.9.3 (TS 6 was tried but breaks resolution of the SDK through the symlink). Adds a documented diff: 4.0.4 override patching GHSA-73rr-hh4g-fpgx (LOW) reachable through ts-node.
• Cleans up unused imports in src/mfa.ts and adds the required isSandbox field to the src/payments.ts example so pnpm run build passes.

Test plan

• pnpm install --frozen-lockfile succeeds (preinstall audit + signatures clean).
• pnpm run build emits dist/ without errors.
• pnpm run example:auth (or any other example:*) still runs under ts-node against the linked SDK.
• CI passes commit-lint (conventional commits enforcement).

🤖 Generated with Claude Code

[jhonatan-pluggy]

LGTM