fix(lint): clear the last tranche-A suppression — require.context under a file-wide no-undef (#125)

* chore(security): enable the npm supply-chain cooldown on npm 11

Sets `min-release-age=2` and `min-release-age-exclude[]=@conduction/*`, raises
`engines.npm` to ^11.0.0, and regenerates the lockfile under npm 11.

The .npmrc comment here has described a cooldown for months and it has never
been in effect. `min-release-age` does not exist in npm 10 — `npm config get
min-release-age` answers `undefined` — and every Node 22 release bundles npm
10, so the setting was read by nothing. Most repos also had it at 0, which
disables it outright.

@conduction/* is exempt because without the exemption the cooldown does not
fail loudly, it silently resolves backwards: measured 2026-08-15, an install of
@conduction/nextcloud-vue on release day picked 2.0.7 instead of 2.3.0 and
exited 0.

The lock is regenerated under npm 11 and iterated to a fixed point. Where the
tree changed rather than its metadata, that is npm 10 -> 11 reconciling a lock
shaped by the older resolver, not the cooldown — verified by regenerating with
the cooldown enabled and disabled and getting identical trees.

Verified: npm ci exit 0 under npm 11.19.0, @conduction/nextcloud-vue resolves
to 2.3.0, gate-84 conformance passes.

* ci: re-run against the merged shared workflow

`gh run rerun` replays the workflow version resolved when the run was created,
so a reusable workflow referenced as @main is NOT re-resolved — every re-run
after ConductionNL/.github#469 merged still executed Node 22 with npm 10.9.8,
where `min-release-age` does not exist and `npm ci` cannot read an npm-11
lockfile. Only a new run picks up the merged workflow. This empty commit is
that trigger.

* fix(lint): clear the last tranche-A suppression — require.context under a file-wide no-undef

`require.context()` is a WEBPACK build-time API the bundler rewrites at compile
time, so eslint is right that no runtime `require` exists and the code is right
too. The file-wide `no-undef` suppression that recorded this also switched the
rule off for every OTHER identifier in the file, so a genuine typo there would
have been silent. Scoped to `/* global require */`.

Same shape found in 9 apps across the fleet; all cleared the same way.

Verified: eslint 0 errors, build exit 0, tests pass.

Author: rubenvdlinde

eslint-suppressions.json

@@ -445,11 +445,6 @@
       "count": 1
     }
   },
-  "src/utils/mergeManifestFragments.js": {
-    "no-undef": {
-      "count": 1
-    }
-  },
   "src/views/Views.vue": {
     "@nextcloud/no-deprecated-library-props": {
       "count": 4

src/utils/mergeManifestFragments.js

@@ -51,6 +51,12 @@ export function applyManifestFragments(base, fragments) {
  * @return {object} The manifest with all fragment pages/menu appended.
  */
 export function mergeManifestFragments(base) {
+	// `require.context` is a WEBPACK build-time API, not CommonJS `require`:
+	// the bundler rewrites this call at compile time and no `require` exists at
+	// runtime. eslint's browser globals therefore report `no-undef` correctly —
+	// the code is right and the linter is right. Scoped to this one identifier
+	// so a genuinely undefined name elsewhere in the file still fails.
+	/* global require */
 	const ctx = require.context('./../manifest.d/', false, /\.json$/)
 	const fragments = ctx
 		.keys()