Harden pnpm install-script policy

[andersmyrmel]

Summary

• pin pnpm 10.34.5 and enforce strictDepBuilds with reviewed exact-version allowBuilds
• allow the required esbuild installers and deny the optional fsevents build
• isolate dependency installation from npm credentials in the release workflow
• harden CI cache keys, frozen-lockfile installs, contributor setup, and the Husky hook
• bump @andersmyrmel/vard to 1.2.1

Supply-chain audit

• no malicious Keyv/Cacheable campaign version was found in pnpm-lock.yaml
• reviewed all dependency lifecycle requesters: esbuild@0.21.5, esbuild@0.25.10, and fsevents@2.3.3
• verified that removing an esbuild approval makes pnpm fail with ERR_PNPM_IGNORED_BUILDS

Verification

• pnpm --version → 10.34.5
• pnpm install --frozen-lockfile in a disposable checkout
• CI=true pnpm test:run → 197 passed, 20 skipped
• pnpm typecheck
• pnpm lint
• pnpm build
• pnpm pack and tarball manifest/content inspection
• git diff --check

The release workflow publishes a prebuilt tarball with npm publish --ignore-scripts, and does not expose npm credentials to dependency installation.