[codex] migrate to pnpm security defaults

[svarlamov]

Summary

• migrate VS Code and OpenCode package workspaces from npm lockfiles to a pnpm 11.5.2 workspace lock
• add strict pnpm supply-chain security policy: one-week minimum package age, exact current-version age exceptions where existing selected packages were newer than the gate, strict lockfile policy checks, trust downgrade protection, exotic dependency blocking, strict peer/engine checks, and explicit build-script allowlists
• update GitHub Actions, release flows, global registry tooling, and docs to use pnpm

Why

This hardens dependency installation against common supply-chain risks: freshly published malicious packages, lockfile-only trust drift, unreviewed install scripts, npm/yarn fallback, and undeclared package-manager drift.

Validation

• pnpm install --frozen-lockfile
• pnpm install --frozen-lockfile --config.node-version=20.18.1
• (agent-support/opencode) pnpm install --frozen-lockfile && pnpm run type-check
• (agent-support/vscode) pnpm install --frozen-lockfile && pnpm run compile && pnpm run lint