npx wrangler needs account_id when using an API token (it can't do the
account-lookup dance that OAuth login provides).

make deploy rebuilds from source (shrinko8 + pico8), which can't run in a
headless CI container. ci-deploy assembles from the committed npicomx.js /
npicomx.p8 and calls wrangler directly — no python3 or pico8 needed.

Also removes pnpm from nixery deps (no package.json in this repo).

nodePackages.pnpm → pnpm: Docker image refs must be lowercase, and pnpm
is also available as a top-level nixpkgs attribute.