V3 pnpm toolchain capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local pnpm CLI ingredient exposes bounded project operations for readiness, test execution, dependency audit, and CycloneDX SBOM generation. Project operations run from an explicit project directory cwd supplied at execution time, avoid caller-supplied pnpm flags, avoid shell wrappers, and keep diagnostics visible as text or JSON output. Test execution is approval-gated because package scripts execute project-defined code. Dependency audit is approval-gated because pnpm sends dependency inventory to the configured package registry. SBOM generation is local and read-only, and requires pnpm 11 or newer. Requires pnpm on PATH.