feat: quarantine third-party releases in scaffolded workspaces

[pyramation]

Summary

Every workspace pgpm init creates now starts with a 14-day quarantine on third-party releases, which is where most compromised releases (hijacked maintainer account, typosquat, postinstall stealer) are caught and yanked. Both workspace templates (pnpm/workspace, pgpm/workspace) gain a pnpm-policy.yaml, the generated block in pnpm-workspace.yaml, policy / policy:check scripts, and a policy:check step in the template CI so the two cannot silently drift.

The exemption default is @____username____/* — npm reserves @<your-username> for you, so it is the one scope a scaffolded project can claim without asking. Commented next to it is how a maintainer widens that to whole npm accounts (maintainers: + pnpm-policy inventory), plus commented examples for allowBuilds and a time-boxed exceptions waiver.

Two things the templates deliberately do not do:

• No blanket build approvals. allowBuilds: [] keeps install scripts off until someone names one and says why.

• No standing waiver for pnpm-policy itself. A scaffold has no lockfile, so its first install resolves everything from the registry and fails if any version — including pnpm-policy or its pinned yamlize/nested-obj — is younger than the wait. Waiving that permanently would scar the config for a transient condition, so the README documents the one-time escape instead, after which the committed lockfile makes it moot:

  pnpm install --config.minimumReleaseAge=0

Requires pnpm-policy ≥ 0.2.2 (constructive-io/dev-utils#111), which is what lets generate/check run before a lockfile exists; the templates pin ^0.2.2.

Verified by scaffolding pnpm/workspace into a temp dir with the placeholders substituted: install, policy:check clean against the committed block, and a --frozen-lockfile re-install.

Link to Devin session: https://app.devin.ai/sessions/ffa3b012deac4eb7afb8f49a9af9f9ca
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring