Add min-release-age to prevent supply chain attacks

[judeallred]

See https://chia-network.atlassian.net/browse/SEC-1019 and #security_chat for context

Summary

• Adds min-release-age=1 to .npmrc, telling npm to only resolve package versions published more than 1 day ago
• Lightweight supply-chain-attack mitigation: malicious packages are typically flagged and removed within hours, so a 1-day quarantine avoids installing freshly-published compromised versions

Test plan

• npm install still works correctly
• npm ci still works correctly

Made with Cursor

---

Note

Low Risk
Low risk configuration change that only affects npm dependency resolution by avoiding newly published versions; potential impact is install failures if a required package is <1 day old.

Overview
Adds min-release-age=1 to .npmrc so npm will only resolve dependency versions published at least one day ago, reducing exposure to freshly published malicious packages.

^{Reviewed by Cursor Bugbot for commit 2788a28. Bugbot is set up for automated code reviews on this repo. Configure here.}

[hoffmang9]

@BugBot review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2788a28. Configure here.}

[github-actions]

'This PR has been flagged as stale due to no activity for over 60
days. It will not be automatically closed, but it has been given
a stale-pr label and should be manually reviewed.'