feat: quarantine third-party releases in scaffolded workspaces

[pyramation]

Summary

Every workspace pgpm init creates now waits 14 days before installing a third-party release, which is where most compromised releases (hijacked maintainer account, typosquat, postinstall stealer) are caught and yanked. Both workspace templates gain a pnpm-policy.yaml, the generated block in pnpm-workspace.yaml, policy / policy:check scripts, and a policy:check CI step so the two cannot silently drift.

Nothing is exempt. The generated block is a bare minimumReleaseAge with no minimumReleaseAgeExclude at all — a scaffolded project quarantines pgpm, pgsql-test and every @pgpm/* release exactly like any other dependency. Exemptions only pay off once you publish something yourself, so scopes: / maintainers: are commented instructions rather than a default:

scopes: []   # commented above: - "@____username____"
allowBuilds: []
exceptions: []

Supersedes #38, which defaulted to exempting @____username____/*. That glob was the scaffolder's own scope, not ours, but it is still a whitelist a consumer never asked for — and empty is both stricter and easier to explain.

allowBuilds: [] keeps install scripts off until someone names one and says why.

A scaffold has no lockfile, so its first install resolves everything from the registry and fails if any version — including pnpm-policy itself — is younger than the wait. A permanent waiver would scar the config for a transient condition, so the README documents the one-time escape, after which the committed lockfile makes it moot:

pnpm install --config.minimumReleaseAge=0

Requires pnpm-policy ≥ 0.2.2 (constructive-io/dev-utils#111, published), which is what lets generate/check run before a lockfile exists.

Verified by scaffolding pnpm/workspace into a temp dir with placeholders substituted: install, policy:check clean against the committed block, and a --frozen-lockfile re-install; pgpm/workspace checks clean too.

Link to Devin session: https://app.devin.ai/sessions/ffa3b012deac4eb7afb8f49a9af9f9ca
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring