chore: configure pnpm minimumReleaseAge for supply chain security (#673)

* chore: configure pnpm minimumReleaseAge for supply chain security

Only allow installing packages published at least 7 days ago (10080 minutes)
to mitigate supply chain poisoning attacks. Upgrade pnpm from 10.15.1 to
10.33.0 as this feature requires >= 10.16.0.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: bump pnpm engine requirement to >=10.17.0 for glob pattern support

minimumReleaseAgeExclude with glob patterns (e.g. @ruguoapp/*) requires
pnpm >= 10.17.0. The previous >=10.16.0 floor would silently ignore the
pattern on 10.16.x, blocking internal package installs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>