ci(security): harden CI/CD supply chain and bump pnpm to 11.1.1 (#436)

* chore(deps): upgrade pnpm to 11.1.1

Bumps the corepack-managed pnpm version across the root and the four
Angular example workspaces. pnpm 11 refuses to run install scripts by
default; declare a minimal allowBuilds allowlist in pnpm-workspace.yaml
so only the two packages whose postinstalls the build actually needs
(esbuild, nx) are permitted. The other eight transitively-pulled
postinstalls (sharp, lmdb, workerd, etc.) all fall back to JS paths
or are unused during build, and are explicitly denied.

Also pin the preinstall guard to only-allow@1.2.2 so it no longer
resolves a floating tag from npm on every install.

* ci(security): pin actions to SHAs and harden CI/CD supply chain

Replaces every mutable workflow reference (@main, @v1, @v3, @v4,
@v6.0.2) with a 40-char commit SHA + version comment so Renovate can
keep them current. Composite actions in TanStack/config — previously
pinned to @main — are the highest-impact change: a force-push or
compromised commit there would have given an attacker the npm OIDC
publishing identity plus contents/issues/PR write tokens on the next
push to main.

Other changes in this commit:

- release.yml: set cancel-in-progress: false so a re-push cannot abort
  changesets/action mid-publish and leave partial versions on npm.
  Add environment: release so required reviewers can be configured in
  repo settings for an explicit human gate before publish.

- triage-agent.yml: add a "SECURITY: Untrusted input" preamble to the
  Warp agent prompt. The agent reads attacker-controlled issue text,
  so it must treat that text strictly as data and refuse instructions
  embedded inside it. Also corrected the bug-report template path
  (bug-report.yml -> bug_report.yml) that the agent was failing to
  load.

- check-skills.yml / validate-skills.yml: pin @tanstack/intent to a
  specific version; npm install -g without a version was floating.

- pr.yml preview job: pin pkg-pr-new to a specific version; pnpx
  without a version was floating.

- .github/renovate.json: drop :automergeMinor. Combined with floating
  versions this could have landed a malicious patch without review.

- .github/CODEOWNERS (new): require owner review on workflows, package
  manifests, lockfile, .npmrc, and renovate config. Adjust the owner
  handle to a team once one exists.

- .github/workflows/dependency-review.yml (new): runs
  actions/dependency-review-action on every PR with
  fail-on-severity: high to block PRs that introduce known-vulnerable
  transitive dependencies.

* ci(security): bump TanStack/config pin to latest main SHA

* fix(ci): correct preinstall skip logic for CI

The original `||`-chained preinstall printed "Skipping preinstall..." in
CI but then ran only-allow anyway because `process.exit(1)` triggers
the `||` operator. CI happened to pass when only-allow was unpinned
(npx resolved it differently), but pinning to @1.2.2 forced a fresh
registry resolve in which only-allow strictly checks
npm_config_user_agent — which, when invoked via npx-inside-pnpm, is
npm's, not pnpm's — and rejects.

The fix matches the script's stated intent: when CI=true, exit 0 so
the `||` does not trigger and only-allow is genuinely skipped. Local
installs continue to fall through and enforce pnpm via only-allow as
before.