build: migrate to pnpm, Node 24, supply-chain hardening & npm trusted publishing

[ardeois]

Summary

Major build/CI modernization:

• yarn → pnpm via corepack — pinned packageManager: pnpm@11.7.0; yarn.lock removed, pnpm-lock.yaml added; husky hook now runs pnpm exec lint-staged.
• Node 24 — engines.node: ">=24", .nvmrc = 24, all workflows on Node 24 via actions/setup-node@v4 + pnpm/action-setup@v4 (with cache: 'pnpm').
• Security audit fixed — all 7 advisories (1 high lodash, moderate @octokit/* & js-yaml, low @tootallnate/once) resolved via transitive overrides: in pnpm-workspace.yaml. No major dev-tool bumps (jest 27, eslint 8, prettier 2, etc. unchanged). pnpm audit is clean.
• Supply-chain hardening (pnpm-workspace.yaml):
  • minimumReleaseAge: 2880 — only install dependency releases older than 2 days.
  • allowBuilds: {} — dependency build/postinstall scripts blocked by default (pnpm 11), whitelist as needed.
• npm OIDC trusted publishing (deploy.yml) — permissions: id-token: write (+ contents: write); NPM_TOKEN/NODE_AUTH_TOKEN removed; pnpm publish (via the retained auto release flow) uses OIDC and publishes provenance. Also fixed the leftover $CIRCLE_BRANCH push target → $GITHUB_REF_NAME.

Verified locally on pnpm 11.7.0 / Node 24: clean --frozen-lockfile install, pnpm run build, 125/125 tests, pnpm run lint, and pnpm audit all pass.

Test Plan

• CI (build / lint / test workflows) passes on the PR.
• On merge to main, deploy.yml publishes to npm via OIDC — requires the npmjs trusted publisher to point at this repo + .github/workflows/deploy.yml (workflow name deploy).
• Confirm the published version shows a provenance/attestation badge on npm.

🤖 Generated with Claude Code