chore: add minimum release age protection

[saltcod]

What

Adds a minimum-release-age guard for npm/pnpm so this repo will not install
packages newer than 4320 minutes (72h / 3 days) old at install time.

• Package manager detected: pnpm
• File updated: pnpm-workspace.yaml
• Value: 4320 minutes (72 hours / 3 days)

Why

Recent npm supply-chain attacks (malicious versions of chalk, debug,
color-name, the Shai-Hulud self-propagating worm, etc.) were typically
caught and yanked within hours of publish. Holding new versions for 72 hours
(3 days) before installing them dramatically reduces exposure to 0-day
malicious publishes without meaningfully slowing day-to-day development.

References:

• pnpm: https://pnpm.io/settings#minimumreleaseage
• npm: https://docs.npmjs.com/cli/v11/using-npm/config#min-release-age

Risk / rollout

• No functional change to application code.
• Only affects fresh installs of versions less than 72h old.
• Reversible by removing the setting.

Generated by min-release-age-migration.sh.

[Copilot]

Pull request overview

Adds a pnpm workspace-level safeguard to reduce exposure to newly published (potentially malicious) packages by enforcing a minimum package release age during installs.

Changes:

• Normalizes the workspace package list formatting in pnpm-workspace.yaml.
• Adds minimumReleaseAge: 4320 (72 hours) to delay installing very recently published packages.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.