chore: enforce the 24h supply-chain soak

[unional]

Found by the fleet-wide dead-control audit, which checked all 74 pnpm-workspace repos across unional, cyberuni, repobuddy and justland. This repo had no minimumReleaseAge at all, so nothing held back a freshly-published version of any dependency, direct or transitive.

This is not a new policy — minimumReleaseAge: 1440 is what ~30 repos in the fleet already carry. This one was simply missing it.

The window existed, in the one place it does nothing

.npmrc carried minimumreleaseage. That is not a valid npm or pnpm key — it never reaches pnpm's typed config, so pnpm config get minimumReleaseAge returned undefined and no version was ever held back. The line is removed rather than corrected: leaving a second, non-functional home for the setting is what hid this in the first place.

Both settings, because one without the other does nothing

minimumReleaseAgeStrict is set alongside the window. Without it pnpm runs loose: a too-young package is not rejected, it is appended to minimumReleaseAgeExclude and installed anyway — so the soak excuses itself on every install and the waiver list grows without anyone deciding to add to it.

No exclusion list is added. The install resolves cleanly under the gate.

Verified

pnpm config get minimumReleaseAge        -> 1440
pnpm config get minimumReleaseAgeStrict  -> true
pnpm install --frozen-lockfile           -> resolves, no lockfile change

🤖 Generated with Claude Code

https://claude.ai/code/session_01ETjy9oQGyETyFmDBdR9Egz

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6da3c4b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.15%. Comparing base (a5cf0a7) to head (6da3c4b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #188   +/-   ##
=======================================
  Coverage   99.15%   99.15%           
=======================================
  Files           9        9           
  Lines         118      118           
  Branches       44       44           
=======================================
  Hits          117      117           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.