fix: restore shared libzmq builds

[fettpl]

Summary

• restore the zmq_shared=true build option that existed before the CMake migration
• skip vcpkg when a system libzmq is requested
• discover and link the shared library through pkg-config
• document the .npmrc option

Verification

Tested on macOS arm64 with Node 22.22.3, CMake 4.4.2, Ninja 1.13.2, pkgconf 3.0.5, and Homebrew zeromq 4.3.5_2:

-- ZMQ_SHARED: ON
-- Found PkgConfig: /opt/homebrew/bin/pkg-config (found version "3.0.5")
-- Checking for module 'libzmq'
--   Found libzmq, version 4.3.5
[9/9] Linking CXX shared library addon.node

otool -L confirms the addon links /opt/homebrew/opt/zeromq/lib/libzmq.5.dylib. Requiring the package reports libzmq 4.3.5 and constructing/closing a Pair socket succeeds. Type checks and ESLint complete without errors; existing unrelated warnings remain.

Fixes #736 and unblocks Homebrew/homebrew-core#297372.

@aminya please review the CMake path and publish a release after merge so downstream packaging can consume it.

[fettpl]

@aminya CI exposed two toolchain-drift failures on fresh builds:

• setup-cpp bootstrapped the latest vcpkg executable before CMake checked out the repository's older pinned vcpkg baseline, producing an incompatible tool/repository combination.
• The Alpine image installed an unpinned latest pnpm, which now rejects the existing lockfile.

I pushed a separate commit pinning vcpkg to the existing baseline and pnpm to the packageManager version (10.8.0). Because this updates .github/workflows/CI.yml, GitHub marked the replacement run as action_required. Could you approve workflow run 31174591754?

[fettpl]

@aminya all jobs that obtained runners now pass. The remaining three stayed queued because windows-2019 and macos-13 are no longer available GitHub-hosted runner labels.

I pushed 52555d6, replacing them with windows-2022 and macos-15-intel. GitHub requires approval for the new workflow run 31245326662. Could you approve it?

[fettpl]

@aminya I pushed 7439362 for the only remaining failure: the Package job now installs JavaScript tooling with --ignore-scripts, avoiding a redundant native rebuild before merging the successful matrix artifacts.

All failure classes from run 31172168126 are resolved in the replacement platform jobs. Could you approve run 31254945575 to validate Package and SmokeTest?

[aminya]

Thanks for your contribution and for fixing the CI matrix as well.

[aminya]

Published in https://github.com/zeromq/zeromq.js/releases/tag/v6.6.0