chore: self-publishing scaffolding (fork compiler, GitHub Packages)

Everything needed to build and publish this branch while
aws/jsii-compiler#2663 is unreleased — kept out of the upstream-facing
ruby-language-bindings branch:

- root resolutions pin: jsii -> patch:@omarqureshi/jsii (fork compiler
  with the targets.ruby schema) + the findPackageJsonUp patch
- jsii-rosetta patch skipping the (not yet released) ruby translator
- .yarnrc.yml: @omarqureshi scope on npm.pkg.github.com, age gate off
- CI: NODE_AUTH_TOKEN + packages: read for GitHub Packages installs
- align-version.sh: ignore the fork pin's >=0.0.0-0 range syntax
- root typescript >=6.0.x + jsii-pacmak devDep; jsii-calc workspace
  devDeps for pacmak --recurse

This branch is what omarqureshi/blog consumes. Rebase it onto
ruby-language-bindings whenever that moves; this commit is the only
delta.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Omar Qureshi

.github/workflows/main.yml

@@ -9,6 +9,10 @@ on:
 env:
   DOTNET_NOLOGO: true
   NODE_OPTIONS: --max-old-space-size=4096
+  # .yarnrc.yml reads this to authenticate against npm.pkg.github.com for the
+  # @omarqureshi scope (GitHub Packages requires auth even for public
+  # packages). Jobs that run `yarn install` also need `packages: read`.
+  NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 # This workflows currently has the following jobs:
 # - build                   : Builds the source tree as-is
 #   - test                  : Runs all unit tests against the build result
@@ -19,6 +23,7 @@ jobs:
     name: Build
     permissions:
       contents: read
+      packages: read
     runs-on: ubuntu-latest
     steps:
       # Check out the code
@@ -107,6 +112,7 @@ jobs:
     name: Create Release Package
     permissions:
       contents: read
+      packages: read
     runs-on: ubuntu-latest
     steps:
       # Check out the code
@@ -192,6 +198,7 @@ jobs:
   test:
     permissions:
       contents: none
+      packages: read
     name: Test (${{ matrix.title }})
     needs: build
     strategy:

.github/workflows/auto-approve.yml …thub/workflows_disabled/auto-approve.yml.github/workflows/auto-approve.yml renamed to .github/workflows_disabled/auto-approve.yml .github/workflows/auto-approve.yml renamed to .github/workflows_disabled/auto-approve.yml

@@ -1,3 +1,4 @@
 # Helps with using npm package-locally, while in a yarn workflow (avoids coupling scripts to yarn).
 # This is needed because yarn goes out of it's way to ensure it controls what `node` binary is used (for good!)
 scripts-prepend-node-path=auto
+@omarqureshi:registry=https://npm.pkg.github.com