ci: harden .npmrc (release-age cooldown + block git-URL deps) (#29)

* ci: add 7-day npm release-age cooldown (.npmrc min-release-age)

npm has no default cooldown (unlike pnpm@11). Set min-release-age=7
so resolution only picks versions published >=7 days ago, giving
time for malicious releases to be caught/yanked before install.
CI already uses --ignore-scripts and package-lock=false, so this
gates every resolve. Per the TanStack/Snyk supply-chain advisory.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: block git-URL deps (.npmrc allow-git=none)

Git dependencies can ship a .npmrc that overrides the git executable
path, enabling arbitrary code execution at install (the actual
TanStack attack vector). npm CLI 11.10+ supports allow-git=none, and
v12 is expected to make it the default. No current dep uses a git URL.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: arv

.npmrc

@@ -1 +1,12 @@
 package-lock=false
+
+# Supply-chain hardening: only install npm versions published >=7 days ago,
+# so freshly-compromised releases are likely caught/yanked before we pull them.
+# https://snyk.io/blog/tanstack-npm-packages-compromised/
+min-release-age=7
+
+# Block git-URL dependencies entirely (npm CLI v11.10+). Git deps can ship
+# their own .npmrc and override the git executable path, enabling arbitrary
+# code execution during install (the actual TanStack attack vector). No
+# current dep needs this and npm v12 is expected to make none the default.
+allow-git=none