ci: pin pnpm/setup to v2.1.0

v3.0.0 keys the store cache with a per-invocation suffix so every job in
a matrix saves a full store copy, and its lockfile-verification cache
shares one exact key across all jobs; together they produced duplicate
save warnings and ~130s/run of discarded post-step compression work
(pnpm/setup#55, pnpm/setup#56). v2.1.0 saves once per lockfile hash and
skips the post-step save on cache hits.

Author: EhabY

.github/actions/setup/action.yml

@@ -10,7 +10,7 @@ runs:
       # Needed for git-based deps (e.g. github:coder/coder) so pnpm can clone without SSH.
       run: git config --global url."https://github.com/".insteadOf "git@github.com:"
 
-    - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+    - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
       with:
         runtime: node@22
         cache: true

.github/workflows/publish-extension.yaml

@@ -34,7 +34,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
           runtime: node@22
 
@@ -77,7 +77,7 @@ jobs:
       contents: read
     if: ${{ needs.setup.outputs.hasVscePat == 'true' }}
     steps:
-      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
           runtime: node@22
           install: false
@@ -111,7 +111,7 @@ jobs:
       contents: read
     if: ${{ needs.setup.outputs.hasOvsxPat == 'true' }}
     steps:
-      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
           runtime: node@22
           install: false