[MatiasFernandez]

Summary

Adds preventive supply-chain controls so a compromised dependency (the Shai-Hulud / SHA1-Hulud worm class) can't execute arbitrary code at install time — closes #246.

• Raise the dev-toolchain npm floor to 11.16 (.nvmrc → 24.19.0, root devEngines) — the minimum version that supports strict-allow-scripts/npm approve-scripts, with the prepare CI job and acceptance/Dockerfile fixed to match.
• Adopt npm's install-script allowlist — strict-allow-scripts=true + a version-pinned allowScripts table in package.json makes an unreviewed install script fail-closed instead of silently running. Approves the tree's 5 current install-script deps, denies fsevents, and backs the control with a new lint:supply-chain CI check so rm .npmrc can't silently disable it.
• Add a release-age cooldown and Dependabot config — min-release-age=7 guards local npm install/update (the only path that can still pull a freshly published malicious release, since the lockfile pins every version), mirrored by a 7-day Dependabot cooldown with an install-scripts group so ESTRICTALLOWSCRIPTS bumps land in one predictable PR per cycle.
• Repair drifted mime/sax lockfile entries — a prior release-bump find-and-replace left their version field disagreeing with the tarball their own resolved URL points to, which silently breaks advisory scanning and hard-blocks npm audit signatures.
• Enforce lockfile integrity and registry signatures in CI — lockfile-lint (host/HTTPS/integrity), npm audit signatures, and a new version-vs-resolved drift check that closes the exact gap that let mime/sax drift unnoticed for two months.
• Seeds a Diátaxis-organized docs/ split (explanation/how-to/reference) for the new controls, with an index.

Test plan

• npm ci succeeds with no EBADDEVENGINES / ESTRICTALLOWSCRIPTS
• npm run lint && npm run format:check && npm run compile && npm test
• npm run package (vsce's dependency walk, ships koffi's native binary) + npm run test:gci against a live stone
• .vsix contents exclude .npmrc/.nvmrc
• Negative tests: allowlist fail-closed on a removed allowScripts entry, lint:supply-chain catches a missing .npmrc and a drift lockfile entry, lockfile-lint catches a tampered resolved host
• npm audit signatures passes over the full tree
• CI: prepare, lint, and floor jobs green end to end

[npapagna]

🤖 Claude's code review of this branch. Six findings below, all inline except one: client/src/__tests__/rowanLoad.test.ts isn't part of this diff, so a line comment can't be anchored there, but flagging it here since it's directly relevant to the last finding on lintSupplyChain.test.ts — updateGitRepo's setup() helper (line 161) creates a second tempdir via mkdtempSync that is never cleaned up anywhere in the file (only the module-level root is removed, in the top-level afterEach). Every run of the two tests that call setup() (lines 191, 197) leaks a directory (seed repo, bare remote, clone, and any bump()-created pusher clones) into the OS temp folder permanently. This is exactly the class of bug withTemporaryFolderDo (client/src/__tests__/support/file.ts:33) already exists to prevent via its finally-block cleanup — worth a follow-up fix even though it's outside this PR's diff.

[npapagna]

Works great @MatiasFernandez!
Left a couple of comments.