Harden supply chain settings

[decofe]

Summary

• add pnpm overrides for scanner-reported vulnerable transitive packages while preserving existing direct dependency ranges
• move pnpm build-script hardening out of the ignored package.json#pnpm block and keep it in pnpm-workspace.yaml
• update pinned GitHub Actions SHAs, disable checkout credential persistence for read-only jobs, and avoid direct expression interpolation in shell/script blocks
• remove CI's repository secret read for static builds by using a non-secret placeholder key

Verification

• osv-scanner scan source -r . -> No issues found
• pnpm check:ci
• node scripts/generate-discovery.ts && pnpm check:types
• pnpm test
• pnpm mcp-services:check
• MPP_SECRET_KEY=ci-placeholder-key-for-static-ci-builds timeout 240s pnpm build
• zizmor .github/workflows/ still flags the three existing pull_request_target workflows; those are intentional comment/label automations retained for equivalent behavior

Prompted by: @0xalpharush

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mpp	Error		Jun 26, 2026 6:22pm