chore(deps): say what the pdf-parse copy of pdfjs is still for

The override comment said pdf-parse's pdfjs 5.4.296 drives local text
extraction. Extraction now reads with the app's own pdfjs; only the tests
still use pdf-parse, which has to stay on pdfjs 5 because its teardown
calls an API pdfjs 6 removed. The range itself is unchanged.

pnpm-workspace.yaml

@@ -73,8 +73,10 @@ overrides:
   # transitively, and `outputFileTracingIncludes` ships EVERY `pdfjs-dist@*` in
   # the store into the standalone image — so an unused transitive copy is still
   # a copy in the runtime image. The range is bounded on both ends deliberately:
-  # `pdf-parse` resolves 5.4.296, which predates the flaw and drives the local
-  # text-extraction path, so it must not be dragged onto a new major.
+  # `pdf-parse` resolves 5.4.296, which predates the flaw. Only the tests use it
+  # now (they read generated PDFs back); it must not be dragged onto a new
+  # major, because its teardown calls `PDFDocumentProxy.destroy()`, which pdfjs
+  # 6 no longer has. Local text extraction reads with the app's own pdfjs.
   "pdfjs-dist@>=5.6.83 <6.2.108": "6.2.108"
   # Deeply nested input drives DeepmergeTS into unbounded recursion until the
   # stack gives out. The copy here is Prisma's: `@prisma/config` still asks for