chore(security): require 24h cooldown on npm packages (#42)

Defense against supply-chain attacks (e.g. shai-hulud, nx-style
compromised publishes) by blocking install of any package version
published less than 24h ago.

- .npmrc: new; `min-release-age=1` (npm 11.5+ native; older npm ignores it)
- .github/dependabot.yml: add `cooldown.default-days: 1` to the existing
  npm entry, with @conduction/* excluded so first-party releases reach
  this repo immediately

For release-day consumption of fresh @conduction/* deps, use
`npm install --min-release-age=0 @conduction/pkg@x.y.z`.

Author: rubenvdlinde

.github/dependabot.yml

@@ -18,3 +18,9 @@ updates:
       time: "03:00"
       timezone: Europe/Paris
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 1
+      include:
+        - "*"
+      exclude:
+        - "@conduction/*"

.npmrc

@@ -0,0 +1,5 @@
+# Supply-chain hardening: reject any npm package published less than
+# 24h ago. Compromised first-party-Conduction packages are excluded via
+# Dependabot cooldown (.github/dependabot.yml); for fresh @conduction/*
+# releases, override per-install with `npm install --min-release-age=0`.
+min-release-age=1