chore: pin all dependencies to exact versions

[John-David Dalton (jdalton)]

This action installs a security control, so what ships inside its bundled dist/ should only change when someone decides to change it. With ^ ranges on every dependency, that was not true: any fresh npm install in this repo could pull a newer transitive tree into the next build, and the difference would land in a release without anyone having chosen it.

Pinning every dependency and devDependency to an exact version makes that deliberate. Dependabot still opens PRs to bump versions, so this does not mean going stale — it means every version change arrives as a reviewable commit rather than as a side effect of when the build happened to run.

What else is in here — three supply-chain settings that came along with the pin

Change	Why it matters
New .npmrc with ignore-scripts=true	install-time lifecycle scripts from dependencies no longer execute in this repo
New .npmrc with min-release-age=7	a freshly published version has to sit for a week before it can be installed, which is the window most compromised-release incidents are caught in
engines.node tightened from >=24 to >=24.14.1	pins the Node line the bundle is built and tested against, rather than any 24.x

rollup also moves from ^4.52.2 to exactly 4.52.3, so the pin captures the version currently resolving rather than freezing an older one. The rest of the package-lock.json churn is npm re-recording peer markers after the re-resolve.

The test plan — unchecked; two things to confirm before merge

• Verify npm install resolves correctly with pinned versions
• Verify npm run build still works

[John-David Dalton (jdalton)]

Already satisfied on main.

#14 pinned every dependency to an exact version as part of fleet onboarding — all 44 entries in package.json are exact, with no ^ or ~ ranges left. The repo also moved from npm to pnpm, so package-lock.json is gone and .npmrc is now fleet-managed, leaving nothing here to apply.