Pages wrangler.toml doesn't accept account_id (Workers-only key).
Pass CLOUDFLARE_ACCOUNT_ID inline in the Makefile target instead.

npx wrangler needs account_id when using an API token (it can't do the
account-lookup dance that OAuth login provides).

make deploy rebuilds from source (shrinko8 + pico8), which can't run in a
headless CI container. ci-deploy assembles from committed picosky*.js / .p8
artifacts and calls wrangler directly — no python3 or pico8 needed.

Also removes pnpm from nixery deps (no pnpm install step needed for npx wrangler).

nodePackages.pnpm → pnpm: Docker image refs must be lowercase, and pnpm
is also available as a top-level nixpkgs attribute.