chore(pnpm): require 7-day minimum release age for installs (#2603)

Configures pnpm's minimumReleaseAge to 10080 minutes (7 days) so newly
published package versions can't be installed until they've existed on
the registry long enough for short-lived supply-chain compromises (e.g.
hijacked publish tokens, typosquats) to be detected and yanked. 7 days
is the post-Shai-Hulud/tj-actions community baseline.

Critical hotfixes can still be installed by adding entries to
minimumReleaseAgeExclude.

Ref: https://pnpm.io/blog/2025/12/05/newsroom-npm-supply-chain-security