DENG-215: pin + 7-day dependency cooldown (.npmrc)

[m242]

DENG-215 — dependency supply-chain hardening (Tier 1: config)

This PR adds .npmrc to enforce dependency policy at install time.

save-exact=true     # pin: future `npm install <pkg>` writes exact versions
save-prefix=        # no range prefix
min-release-age=7   # 7-day cooldown: only versions published >7 days ago resolve

Requires npm ≥ 11 (Node 24 ships it) for min-release-age to take effect. CI/dev on older npm will ignore the cooldown line (safe no-op).

• Cooldown applies to new/updated deps; npm ci from the committed lockfile is unaffected.
• A follow-up PR will pin existing floating ranges (0 found) and regenerate the lockfile.

Ref: https://fenderdigital.atlassian.net/browse/DENG-215