feat(constructive-pnpm-policy): our policy data + weekly inventory refresh

[pyramation]

Summary

The data half of the pnpm-policy split: @constructive-io/pnpm-policy ships our config and the generated inventory of everything maintainer:pyramation publishes, so our workspaces pin one reviewed exemption list instead of each keeping a copy.

Data only — no main, no bin, no install scripts. A package whose job is to say "these names skip the quarantine" should not also be able to run anything, so it exports two files and nothing else:

{ "exports": { "./pnpm-policy.yaml": "./pnpm-policy.yaml", "./inventory.json": "./inventory.json" } }

Real numbers from the generated inventory: 1106 packages → 6 scope globs + 891 names, and against constructive-db's lockfile that resolves to 6 globs + 70 names, 821 omitted. Verified end-to-end from a scratch consumer that resolves the inventory out of node_modules:

inventory: "@constructive-io/pnpm-policy/inventory.json"

Updated pnpm-workspace.yaml: 2w wait, 6 scope glob(s), 70 first-party package(s), 0 exception(s)
821 first-party package(s) omitted — this workspace does not resolve them
pnpm-workspace.yaml matches the policy

The refresh workflow

Weekly + workflow_dispatch, throttled at 1000 ms (5 requests, ~8s). It opens a PR instead of committing, because a name landing in the inventory is a name that stops being quarantined, and that deserves a human glance. Permissions are just contents: write + pull-requests: write — the npm search endpoint is anonymous, so no registry token. No third-party actions, gh only.

generatedAt changes on every run, so a timestamp-only diff is suppressed rather than opening a weekly no-op PR:

if [ "$(git diff -U0 -- "$file" | grep -c '^[+-][^+-]')" -le 2 ] \
  && [ -z "$(git diff -U0 -- "$file" | grep '^[+-][^+-]' | grep -v generatedAt)" ]; then
  echo "Only generatedAt changed."; exit 0
fi

Scopes claimed

Six: @constructive-io @constructive-db @launchql @pgpm @pgpmjs @pgsql. I checked each for foreign publishers (0 found across 12 candidate scopes), but that's best-effort — npm has no "list a scope" API — so claiming is a deliberate line in the config rather than something the tool infers. @agentic-kit @decryption @inquirerer @interweb @kubernetesjs @lql-pg also look wholly ours and are noted in a comment; they're currently covered by name via the inventory, so leaving them unclaimed costs nothing except a refresh when a new package appears there.

Not here

Nothing in constructive-db was touched — adopting the policy there (it currently runs minimumReleaseAge: 0) is the next PR.

Link to Devin session: https://app.devin.ai/sessions/ffa3b012deac4eb7afb8f49a9af9f9ca
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring