chore(ci): harden supply-chain controls before reopening PRs

Isolate npm publish from PR CI, enforce frozen lockfiles and a 24h
minimumReleaseAge, and document safe pull_request_target usage so fork
PRs cannot reach publish credentials.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

.github/workflows/publish-course-app.yml

@@ -1,15 +1,19 @@
 name: Publish @classroomio/course-app to NPM
 
-on: workflow_dispatch
+# Publish-only via manual dispatch. Do not add pull_request triggers here.
+
+on:
+  workflow_dispatch:
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    environment: production
     permissions:
-      packages: write
       contents: read
     steps:
       - uses: actions/checkout@v4
+
       - uses: actions/setup-node@v4
         with:
           node-version: 20.19.3
@@ -17,11 +21,13 @@ jobs:
 
       - uses: pnpm/action-setup@v4
 
-      - name: Install, Build & Publish
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build & Publish
         working-directory: packages/course-app
         run: |
-          pnpm i
           pnpm build
           pnpm publish --no-git-checks
         env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}