Task: Fix OpenMAIC frozen lockfile build

Identity

Synchronize OpenMAIC/pnpm-lock.yaml with the current workspace manifests so packages/@makelore/learning-contracts is represented and Docker's frozen install can pass.
Make the CPU ACK image resilient to onnxruntime-node's unnecessary CUDA postinstall download while keeping the frozen-lockfile policy.
Verify the lockfile and the supported CPU install-script path with pnpm 10.28.0 and the repository's pinned Node runtime.

The first failure was a dependency metadata mismatch: the learning contracts package was added after the lockfile was last generated.
The follow-up failure is an onnxruntime-node@1.23.2 postinstall request for CUDA 12 metadata; the Jenkins proxy returned HTTP 302 while the script only accepts HTTP 200.
Use the package-manager version pinned by the Dockerfile (pnpm@10.28.0) when regenerating the lockfile.
Preserve the user's known .project-docs/ adoption and avoid unrelated workspace changes.

Added the missing packages/@makelore/learning-contracts importer to OpenMAIC/pnpm-lock.yaml with the existing resolved TypeScript and Vitest entries. No unrelated pnpm 10.28 reserialization changes were retained.
The original Dockerfile policy remains pnpm install --frozen-lockfile.
Committed locally on main as e1a0a14 (fix: sync learning contracts lockfile).
Updated OpenMAIC/Dockerfile to set ONNXRUNTIME_NODE_INSTALL=skip in the dependency stage. The package's CPU runtime remains bundled; CUDA download is now an explicit opt-in and requires a CUDA-capable runner image.

pnpm install --frozen-lockfile --ignore-scripts passed with pnpm 10.28.0.
pnpm --filter @makelore/learning-contracts test passed: 1 file, 3 tests.
git diff --check passed; lockfile diff is limited to 9 importer lines.
Read-only final review returned PASS; the importer matches the manifest and existing lockfile peer snapshot, with no Dockerfile or application-code changes.
The onnxruntime-node install script exited 0 with ONNXRUNTIME_NODE_INSTALL=skip; bundled Windows and Linux CPU binding files were present.
Full Windows pnpm install --frozen-lockfile reached the existing postinstall chain and failed because rm is unavailable on Windows; the Dockerfile runs this chain inside Linux Alpine, so this is not the reported Jenkins failure.
Local Docker deps validation remains unavailable because the Docker Desktop Linux engine is not running (dockerDesktopLinuxEngine pipe missing).

Commit and push the lockfile and Dockerfile changes, then rerun the Jenkins Docker build.
Local push to origin/main was blocked because this environment has no authenticated Git credential/TTY; rerun git push origin main from an authenticated terminal.
If a Windows-native install is required, separately replace Unix-only rm usage in package build scripts; that is outside this lockfile fix.
The task-aware doc-drift check is blocked by the pre-existing adopted untracked .project-docs/ template tree; no task-specific shared-doc writes were made.

The Linux Docker build reached onnxruntime-node@1.23.2 postinstall, which assumed CUDA 12 and rejected an HTTP 302 from the NuGet feed.
OpenMAIC/Dockerfile now defaults ONNXRUNTIME_NODE_INSTALL=skip in the dependency stage. The package ships the CPU runtime; GPU builds can opt in with --build-arg ONNXRUNTIME_NODE_INSTALL=cuda12 after fixing NuGet access.
The install script exited 0 with ONNXRUNTIME_NODE_INSTALL=skip locally and both bundled CPU runtime paths were present.
The CUDA override was not exercised end to end. Use it only with a working NuGet/proxy path and a runner image that supplies the CUDA runtime.