chore(ci): harden supply-chain controls before reopening PRs

Isolate npm publish from PR CI, enforce frozen lockfiles and a 24h
minimumReleaseAge, and document safe pull_request_target usage so fork
PRs cannot reach publish credentials.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

.github/workflows/apply-issue-labels-to-pr.yml

@@ -1,19 +1,23 @@
 name: 'Apply issue labels to PR'
 
+# pull_request_target is used so labeling works for fork PRs.
+# SAFE ONLY because this workflow never checks out or executes PR code.
+# Do not add actions/checkout, pnpm install, build, or cache steps here.
+
 on:
   pull_request_target:
     types:
       - opened
 
+permissions:
+  contents: none
+  issues: read
+  pull-requests: write
+
 jobs:
   label_on_pr:
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: none
-      issues: read
-      pull-requests: write
-
     steps:
       - name: Apply labels from linked issue to PR
         uses: actions/github-script@v5