Add min-release-age to prevent supply chain attacks

[judeallred]

See https://chia-network.atlassian.net/browse/SEC-1019 and #security_chat for context

Summary

• Adds min-release-age=1 to .npmrc, telling npm to only resolve package versions published more than 1 day ago
• Lightweight supply-chain-attack mitigation: malicious packages are typically flagged and removed within hours, so a 1-day quarantine avoids installing freshly-published compromised versions

Test plan

• npm install still works correctly
• npm ci still works correctly

Made with Cursor

---

Note

Low Risk
Low risk config-only change that affects dependency resolution timing; could cause installs to fail if a required package version was published within the last day.

Overview
Adds .npmrc setting min-release-age=1 so npm will avoid resolving dependencies published within the last day, providing a lightweight supply-chain hardening measure.

^{Reviewed by Cursor Bugbot for commit d5cf183. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coveralls-official]

Coverage Report for CI Build 26242831614

Coverage decreased (-0.8%) to 80.713%

Details

• Coverage decreased (-0.8%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	18427
Covered Lines:	14873
Line Coverage:	80.71%
Coverage Strength:	12229087.43 hits per line

---

💛 - Coveralls