chore: enforce three-day dependency release age (#19414)

## Summary

- add a three-day cooldown to all six npm Dependabot update entries
- upgrade repository tooling to pnpm 11.23.0 and its minimum Node.js
22.13 runtime
- exclude all @ai-sdk/*, ai, and @vercel/* packages from the pnpm
minimum release age
- migrate pnpm settings to pnpm-workspace.yaml and preserve the
install-script policy with allowBuilds
- replace eight too-new transitive lockfile entries that pnpm 11
supply-chain verification rejected

## Release branch backports

No pnpm 11 backports were opened for release-v6.0 or release-v5.0. Both
branches intentionally run CI on Node.js 20 and pin pnpm 10.33.4
throughout their workflows, while pnpm 11 requires Node.js 22.13 or
newer. A backport would require dropping or splitting that Node.js 20
path.

## Verification

- pnpm --config.confirmModulesPurge=false install --frozen-lockfile
- pnpm check
- pnpm type-check:full