docs: revert canonical examples to npx (blocked on bundling #4760 + npm v12 GA) #4761

Summary

Revert the canonical documentation examples from pnpm dlx projen back to npx projen (with a brief note pointing at pnpm dlx / yarn dlx / bunx equivalents).

This is the follow-up to item (2) of #4601. It is intentionally blocked on two preconditions — see below.

Rationale

• Neutrality. Docs have no "configured package manager"; they're read by npm/yarn/pnpm/bun users alike. npx ships with every Node install and works for everyone. Making pnpm dlx the canonical command silently presumes pnpm and nudges readers toward it — which is item (3) of security: replace npx with pnpm, change default package manager, deprecate NodePackageManager.NPM #4601 (changing the default PM) through the back door, and that was declined.
• Security delta closes. The npm v12 changelog defaults allowScripts off and applies it to npx and global installs (plus --allow-git=none / --allow-remote=none). The one concrete differentiator that motivated the npx → pnpm dlx change — transitive postinstall running by default — goes away for npx itself.
• The residual pnpm-only protections (minimumReleaseAge, trustPolicy) only benefit users already on pnpm, which a doc example can't assume anyway.

Blocked on (do not action until both are true)

• Bundling is fixed — depends on projen lists bundled dependencies in dependencies, so consumers still install them #4760. The "npx projen is safe because everything is bundled" argument only holds once projen stops listing bundled deps in dependencies. Until projen lists bundled dependencies in dependencies, so consumers still install them #4760 lands, reverting docs to npx would still expose readers to transitive registry installs.
• npm v12 is GA and has had a few months of adoption. v12 is estimated for July 2026. Its script-blocking defaults only protect users actually on npm ≥ 12, so we should allow a buffer (suggest revisiting ~Q4 2026) before treating npx as the safe default in docs.

Scope

• Revert npx → pnpm dlx doc changes from item (2) of security: replace npx with pnpm, change default package manager, deprecate NodePackageManager.NPM #4601 (bootstrap projen new examples and any day-to-day task examples in docs).
• Add a one-line note listing the per-PM equivalents rather than privileging one.
• Out of scope: source-code npx handling (tracked in remove hardcoded npx from source code in favour of the configured package manager #4759), default PM (security: replace npx with pnpm, change default package manager, deprecate NodePackageManager.NPM #4601 item 3), NodePackageManager.NPM deprecation (security: replace npx with pnpm, change default package manager, deprecate NodePackageManager.NPM #4601 item 4).

Relates to #4601. Blocked by #4760 and by the npm v12 GA + adoption window.

---

_{🤖 Filed by an AI agent on behalf of @mrgrain, who reviewed and approved this issue.}