chore: harden supply chain config

[decofe]

Summary

• Fix the esbuild advisory by upgrading the direct dev dependency and forcing transitive esbuild resolution to 0.28.1.
• Move pnpm build allowlisting into pnpm-workspace.yaml and add minimum release age hardening.
• Add grouped Dependabot updates for npm and GitHub Actions with cooldowns to avoid high PR volume.
• Harden workflows by removing the release PAT fallback, replacing pull_request_target, disabling setup-node package-manager cache for release artifacts, refreshing pinned Actions, and removing zizmor findings.

Validation

• pnpm audit --json reports 0 advisories.
• osv-scanner scan source -r . reports no issues.
• zizmor .github/workflows/ reports no findings.
• pinact run --diff --check --update --min-age 7 exits cleanly.
• pnpm check fails in this sandbox because sqlite3 is not installed (spawn sqlite3 ENOENT); 100 tests passed before the sqlite3-dependent failures.

Prompted by: @grandizzy

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	esbuild@​0.27.7 ⏵ 0.28.1	+1	+1	+1

View full report