chore(deps): enforce 3-day install quarantine + bump ws to patched 8.20.1+

- .npmrc: pin minimum-release-age=4320 (3 days) for supply-chain
  defence; new versions can't be installed until they've been
  on the registry long enough for typo-squat / compromise to be
  caught and yanked.
- minimum-release-age-exclude=@cloudflare/* so first-party
  packages don't block our own iteration.
- pnpm.overrides forces ws>=8.20.1 transitively via miniflare,
  closing GHSA-58qx-3vcg-4xpx (moderate, uninitialized memory
  disclosure in ws). Dev-only chain, no prod runtime impact, but
  worth keeping clean for dependabot.

.npmrc

@@ -0,0 +1,7 @@
+# Supply-chain hardening: wait 3 days after publish before installing a new
+# version. Catches typo-squat / compromise windows where the malicious version
+# is yanked before it propagates. See:
+# https://pnpm.io/settings#minimumreleaseage
+minimum-release-age=4320
+# First-party packages we publish ourselves should not block our own iteration.
+minimum-release-age-exclude=@cloudflare/*

package.json

@@ -85,5 +85,10 @@
     "vite": "8.0.13",
     "vitest": "^4.1.6",
     "wrangler": "^4.92.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "ws@>=8.0.0 <8.20.1": "^8.20.1"
+    }
   }
-}
+}

pnpm-lock.yaml

@@ -4,7 +4,8 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
-pnpmfileChecksum: sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=
+overrides:
+  ws@>=8.0.0 <8.20.1: ^8.20.1
 
 importers:
 
@@ -1273,8 +1274,8 @@ packages:
       '@cloudflare/workers-types':
         optional: true
 
-  ws@8.18.0:
-    resolution: {integrity: sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==}
+  ws@8.21.0:
+    resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
     engines: {node: '>=10.0.0'}
     peerDependencies:
       bufferutil: ^4.0.1
@@ -1983,7 +1984,7 @@ snapshots:
       sharp: 0.34.5
       undici: 7.24.8
       workerd: 1.20260515.1
-      ws: 8.18.0
+      ws: 8.21.0
       youch: 4.1.0-beta.10
     transitivePeerDependencies:
       - bufferutil
@@ -2199,7 +2200,7 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
-  ws@8.18.0: {}
+  ws@8.21.0: {}
 
   youch-core@0.3.3:
     dependencies: