Apply the 72-hour pnpm baseline to Source

[9larsons]

What changed

• Added minimumReleaseAge: 4320 to enforce an explicit 72-hour dependency cooldown.
• Added strictDepBuilds: true so unapproved lifecycle scripts fail installation.
• Added blockExoticSubdeps: true so transitive dependencies cannot resolve from exotic Git or tarball sources.
• Preserved the existing package-wide dtrace-provider: false denial.
• Kept the build permission surface empty; there are no allowBuilds: true entries.
• Retained pnpm-workspace.yaml in the generated standalone source.zip so standalone installs receive the same policy.

Why

Source is consumed in two forms: Ghost updates it as a full git submodule, and Source releases a standalone theme archive. The submodule path already carries the root configuration, but the zip task explicitly removed pnpm-workspace.yaml, leaving the standalone artifact without the repository's dependency-install policy.

Both paths now retain the same explicit 72-hour and fail-closed pnpm controls without permitting any dependency lifecycle scripts.

This is the Source portion of PLA-321.

Impact

There is no theme runtime behavior change. Newly published dependencies wait 72 hours, unapproved build scripts fail installation, and exotic transitive sources are blocked. The standalone theme zip gains the small pnpm policy manifest; it continues to exclude pnpm-lock.yaml and other development-only files.

Validation

• corepack pnpm --version (11.19.0)
• Effective pnpm settings verified with pnpm config get
• corepack pnpm install --frozen-lockfile (751 lockfile entries passed supply-chain policy verification)
• corepack pnpm build
• corepack pnpm test:ci (zip generation and fatal gscan)
• Standalone fatal gscan after restoring tracked build artifacts
• Verified source.zip contains a byte-identical pnpm-workspace.yaml and excludes pnpm-lock.yaml
• Verified the effective allow map remains only dtrace-provider: false
• git diff --check

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ef5b40db-eaff-47c2-a2e5-b297cf579f37

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}