Add pnpm supply-chain policy (recipe A)

Third-party releases now wait 2 days before install — a compromised
release is normally reported and yanked within hours, so the short
wait catches it without stalling upgrades. The release-age exemption
list (first-party scopes/packages) is derived from what we actually
publish and resolve in this lockfile via @constructive-io/pnpm-policy's
inventory, rather than hand-maintained per repo.

- pnpm-policy.yaml: policy source of truth; pnpm-workspace.yaml's
  policy keys are generated from it and drift-checked in CI.
- allowBuilds: nx (transitive dep of lerna via @nx/devkit) and
  unrs-resolver (transitive dep of jest-resolve) — both needed for
  build/versioning and test tooling respectively.
- blockExoticSubdeps stays true: no git/URL-sourced transitive deps
  found in the lockfile.
- Wired `pnpm run policy:check` into the existing acceptance workflow
  right after `pnpm install`.

Part of the org-wide rollout tracked in
constructive-io/constructive-planning#1464.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEswUi4ANuB58rva48aHge

Author: pyramation

.github/workflows/ci.yml

@@ -60,6 +60,9 @@ jobs:
       - name: Install
         run: pnpm install
 
+      - name: Check supply-chain policy
+        run: pnpm run policy:check
+
       - name: Cache pgpm CLI
         uses: actions/cache@v4
         with:

package.json

@@ -20,21 +20,25 @@
     "test": "pnpm -r run test",
     "lint": "pnpm -r run lint",
     "deps": "pnpm up -r -i -L",
-    "version": "pgpm sync-versions"
+    "version": "pgpm sync-versions",
+    "policy": "pnpm-policy generate",
+    "policy:check": "pnpm-policy check"
   },
   "devDependencies": {
+    "@constructive-io/pnpm-policy": "0.2.1",
     "@types/jest": "^30.0.0",
     "@types/node": "^25.0.3",
     "@typescript-eslint/eslint-plugin": "^8.50.1",
     "@typescript-eslint/parser": "^8.50.1",
+    "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-simple-import-sort": "^12.1.1",
     "eslint-plugin-unused-imports": "^4.3.0",
-    "eslint": "^9.39.2",
     "jest": "^30.2.0",
     "lerna": "^9.0.3",
     "makage": "^0.3.0",
     "pgsql-test": "^4.9.4",
+    "pnpm-policy": "^0.2.2",
     "prettier": "^3.7.4",
     "ts-jest": "^29.4.6",
     "ts-node": "^10.9.2",