chore: tighten CI and document pnpm-only install

.github/workflows/notification.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   pull_request_created:
-    if: github.event_name == 'pull_request' && github.event.action == 'opened' || github.event.action == 'reopened'
+    if: github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'reopened')
     runs-on: ubuntu-latest
     steps:
       - name: Discord Webhook Action

.gitignore

@@ -1,2 +1,6 @@
 .vscode/
 node_modules/
+
+# Only pnpm-lock.yaml at the root is committed; other lockfiles are mistakes.
+package-lock.json
+yarn.lock

README.md

@@ -34,13 +34,14 @@ cd ssa
 
 ### 2. Install dependencies
 
-Install dependencies for each package separately:
+This repo is a pnpm workspace — run a single install at the root and pnpm will handle both packages:
 
 ```bash
-cd web && pnpm install
-cd ../cms && pnpm install
+pnpm install
 ```
 
+> Use pnpm only. `npm install` and `yarn install` are not supported and will produce a broken `node_modules/`.
+
 ### 3. Configure environment variables
 
 Copy the example env file in the CMS and fill in your values: