chore(verify): PR validation workflow, pnpm Solana peer, lockfile check, backup SSH

- Gitea: add validate-on-pr.yml (run-all-validation only; no deploy)
- .env.master.example: document NPM_EMAIL/NPM_PASSWORD for backup-npmplus
- pnpm: allowedVersions for @solana/sysvars to quiet thirdweb/x402 peer drift
- AGENTS + verify README: CI pointers and .env.master.example for env
- backup-npmplus: npm_lxc_ssh helper; keep prior timeout/BatchMode behavior
- check-pnpm-workspace-lockfile + run-all-validation step 1b (from prior work in same commit set)

Made-with: Cursor

.env.master.example

@@ -40,6 +40,8 @@ CLOUDNS_AUTH_ID=
 CLOUDNS_AUTH_PASSWORD=
 
 # --- NPM / NPMplus ---
+# For scripts/verify/backup-npmplus.sh: NPM_EMAIL and NPM_PASSWORD are both required
+# (no in-script defaults); see AGENTS.md operator / backup row.
 NPM_URL=
 NPM_EMAIL=
 NPM_PASSWORD=