[AI] Add npm minimal age gate for supply-chain defense (#8011)

* [AI] Add npmMinimalAgeGate to block dependency versions newer than 3 days

* [autofix.ci] apply automated fixes

* [AI] Add release notes for npm minimal age gate

---------

Co-authored-by: Claude <[email protected]>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

.yarnrc.yml

@@ -11,3 +11,8 @@ yarnPath: .yarn/releases/yarn-4.13.0.cjs
 # Secure default: don't run postinstall scripts.
 # If a new package requires them, add it to dependenciesMeta in package.json.
 enableScripts: false
+
+# Supply-chain defense: don't install package versions published less than 3
+# days ago, giving the community time to catch compromised releases. Trusted
+# packages that need immediate updates can be listed in npmPreapprovedPackages.
+npmMinimalAgeGate: '3d'

upcoming-release-notes/8011.md

@@ -0,0 +1,6 @@
+---
+category: Maintenance
+authors: [MatissJanis]
+---
+
+Add a 3-day minimum age gate for npm dependencies to harden against supply-chain attacks