chore(deps): upgrade to pnpm 11 and harden supply-chain config

package.json

@@ -22,7 +22,10 @@
   "keywords": [],
   "author": "",
   "license": "ISC",
-  "packageManager": "pnpm@10.25.0",
+  "packageManager": "pnpm@11.3.0",
+  "engines": {
+    "node": ">=22.13"
+  },
   "devDependencies": {
     "@types/node": "25.3.3",
     "prettier": "3.8.1",

pnpm-workspace.yaml

@@ -0,0 +1,20 @@
+# pnpm-specific settings live here (pnpm v11 no longer reads non-auth/registry
+# settings from .npmrc). Registry/auth settings, if any, stay in .npmrc.
+
+# Supply-chain hardening
+# Refuse to install package versions younger than 10 days
+minimumReleaseAge: 14400
+# Fail (don't silently downgrade) if a package's publisher trust level drops
+trustPolicy: no-downgrade
+# Known-benign provenance downgrades, vetted and exempted from no-downgrade.
+# Each is a maintainer that stopped publishing with npm provenance (not an
+# attack). Review before adding. See nodejs/undici#4666.
+trustPolicyExclude:
+  - undici-types
+# Transitive deps must resolve from the registry, not git/tarball sources
+blockExoticSubdeps: true
+
+# Dependencies permitted to run install/build scripts (replaces the v10
+# onlyBuiltDependencies list). esbuild fetches its platform binary (via tsx).
+allowBuilds:
+  esbuild: true