Summary

• add a private pnpm 11.5.2 root manifest and lockfile for future Node helper work
• add strict pnpm supply-chain security policy: one-week minimum package age, strict lockfile policy checks, trust downgrade protection, exotic dependency blocking, strict peer/engine checks, and build-script blocking by default
• add node_modules ignore and remove stale npm wording from helper-script comments

Why

This gives the self-hosted repo the same pnpm-only supply-chain guardrails as the application repos before future Node helpers gain dependencies, preventing npm/yarn fallback and unreviewed install behavior.

Validation

• pnpm install --frozen-lockfile
• PATH=/tmp/codex-helm-bin:$PATH ./helm/scripts/test-render.sh
• docker compose -f docker-compose.yml config --format json
• SQL_API_USER=analytics SQL_API_PASSWORD=super-secret docker compose -f docker-compose.yml --profile sql-api config --format json