Help a user who forgot to update their pnpm-lock.yaml

[alexeagle]

We could have some repository rule to re-run pnpm install --lockfile-only and verify that the users file is up-to-date.

Otherwise you might add a first-party dep to your package.json and then Bazel doesn't see that change.

[cgrindel]

@alexeagle Is this addressed by #157?