chore(deps): update trust policy for specific packages w/ notes

pnpm-workspace.yaml

@@ -33,19 +33,34 @@ catalog:
 minimumReleaseAge: 10080
 
 minimumReleaseAgeExclude:
+  # first-party (hugomrdias): published and consumed by us immediately
   - iso-ledger
   - iso-web
   - iso-kv
   - iso-base
   - '@hugomrdias/docs'
-  - viem
-  - ox
   - playwright-test
+  # viem 2.52.0 bump (#810) landed inside cooldown; viem pins ox exactly.
+  # Remove after 2026-06-08 when both age out.
+  - viem@2.52.0
+  - ox@0.14.27
 
 trustPolicy: no-downgrade
 
 trustPolicyExclude:
+  # 0.2.0 published manually without provenance (0.1.9 was trusted-published).
+  # Remove when republished via trusted CI.
   - '@hugomrdias/docs@0.2.0'
+  # 2.0.x published manually; 2.0.2 (2026-06-01) is trusted-published.
+  # Remove after 2026-06-08 when 2.0.2 ages past cooldown.
   - 'astro-mermaid@2.0.1'
+  # tinylibs staged-publishing false positive (npm metadata omitted trusted-publisher
+  # signal, see tinylibs/tinyclip#37); 1.2.4 (2026-05-31) is trusted-published.
+  # Remove after 2026-06-07.
   - 'tinyexec@1.2.2'
+  # Same staged-publishing false positive; tarball diffed clean vs 0.1.12.
+  # 0.1.14 (2026-06-03) is trusted-published. Remove after 2026-06-10.
+  - 'tinyclip@0.1.13'
+  # Last 4.x (Dec 2024) predates chokidar adopting trusted publishing at 5.0.0.
+  # Permanent while anything depends on chokidar@^4.
   - chokidar@4.0.3