install-pnpm latest-version detection breaks when pnpm package.json has a dependency key ending in "version" (@pnpm/engine.runtime.system-version)

Start in src/scripts/install-pnpm.sh at get_pnpm_version() and reproduce the latest-version extraction against pnpm's package.json. Ensure the detected value contains only the top-level version, then verify that the Install pnpm path no longer produces a multiline pnpm version; the issue does not name a specific test file.

Orb version:

circleci/node@7.2.1 (also present on master / install-pnpm.sh)

What happened:

When install-pnpm: true is used without pinning pnpm-version, the latest-version
detection in src/scripts/install-pnpm.sh breaks.

It parses pnpm's package.json from jsdelivr with:

curl -s https://cdn.jsdelivr.net/npm/pnpm/package.json | sed -n 's/.*version": "\(.*\)".*/\1/p'

As of pnpm 11.12.0, package.json contains a dependency whose key ends in version
(@pnpm/engine.runtime.system-version), so the sed matches two lines:

$ curl -s https://cdn.jsdelivr.net/npm/pnpm/package.json | sed -n 's/.*version": "\(.*\)".*/\1/p'
11.12.0
1100.0.3

This makes the script run npm install -g pnpm@11.12.0\n1100.0.3, which fails:

npm error code ETARGET
npm error notarget No matching version found for pnpm@11.12.0
npm error notarget 1100.0.3.

Every job that installs pnpm via the orb without a pinned version currently fails
at the "Install pnpm" step.

Expected behavior:

The orb should detect only the top-level version field, e.g. by parsing the JSON
properly instead of a line-based regex:

PNPM_ORB_VERSION=$(curl -s https://cdn.jsdelivr.net/npm/pnpm/package.json | jq -r '.version')

Additional Information:

This is a different code path from #258 (which was about installation_check()
matching an already-installed major-version-only pin, fixed by #259) — this bug is
in get_pnpm_version()'s latest-version auto-detection instead, so it's filed as a
new issue rather than reopening #258.

Workaround: pin the version explicitly, e.g. pnpm-version: "11.5.1".