chore(deps): upgrade to pnpm 11 and harden supply-chain config

[ElliotWood13]

What

Upgrade pnpm 10.25.0 → 11.3.0 and migrate to pnpm v11's supply-chain hardening model. First of a fleet-wide rollout (PE-1866).

Why

pnpm v11 only reads auth/registry settings from .npmrc — every other pnpm setting must move to pnpm-workspace.yaml. v11 also ships supply-chain protections we want enabled. This PR migrates config and turns on those protections.

Changes

• packageManager: pnpm@10.25.0 → pnpm@11.3.0; add engines.node: ">=22.13" (pnpm 11 floor)
• Removed .npmrc — it held only minimum-release-age, now migrated
• New pnpm-workspace.yaml supply-chain policies:
  • minimumReleaseAge: 14400 (10 days) — refuse versions younger than 10d
  • trustPolicy: no-downgrade — fail on publisher-trust/provenance downgrades
  • blockExoticSubdeps: true — transitive deps must resolve from the registry
• trustPolicyExclude: [undici-types] — reviewed, known-benign provenance gap (nodejs/undici#4666); without it @types/node blocks every install
• allowBuilds: { esbuild: true } — v11 replaces onlyBuiltDependencies; esbuild fetches its platform binary (via tsx)

Test plan

• pnpm install under pnpm 11.3.0 / Node 22.22 succeeds; lockfile unchanged (still v9.0); esbuild postinstall runs
• No install/build CI workflow in this repo (only PR-title lint) — nothing else to verify here

Security & Data Impact

Security impact: Strengthens supply-chain posture — install-time version quarantine, provenance-downgrade detection, registry-only transitive deps. The one trustPolicyExclude entry is a vetted known-benign provenance gap, not a blanket bypass.
Data classification affected: None.
Audit log updated: N/A.

Rollback

Revert commit — no state migration (re-pins pnpm 10.25.0).

[Copilot]

Pull request overview

This PR upgrades the repo’s package manager to pnpm@11.3.0 and migrates supply-chain hardening configuration away from .npmrc into pnpm-workspace.yaml, aligning with pnpm v11’s configuration model.

Changes:

• Bump packageManager to pnpm@11.3.0 and declare a Node engine floor (>=22.13) in package.json.
• Remove .npmrc and migrate the prior minimum-release-age setting into pnpm-workspace.yaml.
• Enable pnpm v11 supply-chain protections (minimum release age, provenance downgrade protections, exotic subdependency blocking) and allow builds for esbuild.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
pnpm-workspace.yaml	Adds pnpm v11 config and supply-chain hardening policies, including build-script allowlist.
package.json	Updates pnpm version and sets Node engine floor required by pnpm v11.
.npmrc	Removes the old pnpm setting now migrated to pnpm-workspace.yaml.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.