[codex] migrate to pnpm security defaults

.gitignore

@@ -0,0 +1,2 @@
+node_modules/
+.pnpm-debug.log*

docker-compose/scripts/create-org.mjs

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import readline from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 
-// --- KSUID generation (ported from npm `ksuid` package) ---
+// --- KSUID generation (ported from the published `ksuid` package) ---
 
 const BASE62_CHARS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 const KSUID_EPOCH_MS = 14e11;

helm/scripts/create-org.mjs

@@ -4,7 +4,7 @@ import { randomBytes } from "node:crypto";
 import readline from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 
-// --- KSUID generation (ported from npm `ksuid` package) ---
+// --- KSUID generation (ported from the published `ksuid` package) ---
 
 const BASE62_CHARS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 const KSUID_EPOCH_MS = 14e11;

package.json

@@ -0,0 +1,16 @@
+{
+  "name": "git-ai-self-hosted",
+  "private": true,
+  "packageManager": "pnpm@11.5.2",
+  "engines": {
+    "node": ">=22.0.0",
+    "pnpm": "11.5.2"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": "11.5.2",
+      "onFail": "error"
+    }
+  }
+}

pnpm-workspace.yaml

@@ -0,0 +1,19 @@
+minimumReleaseAge: 10080
+minimumReleaseAgeStrict: true
+minimumReleaseAgeIgnoreMissingTime: false
+trustPolicy: no-downgrade
+trustPolicyIgnoreAfter: 10080
+trustLockfile: false
+blockExoticSubdeps: true
+resolutionMode: time-based
+engineStrict: true
+strictPeerDependencies: true
+pmOnFail: error
+verifyDepsBeforeRun: error
+strictDepBuilds: true
+dangerouslyAllowAllBuilds: false
+strictSsl: true
+verifyStoreIntegrity: true
+strictStorePkgContentCheck: true
+preferFrozenLockfile: true
+savePrefix: ""