chore: add npm >=11.10 engine constraint to enforce min-release-age

[Xsidz]

Summary

• Added "npm": ">=11.10" to the root engines field in package.json.

Without this constraint, min-release-age=7 in .npmrc is silently ignored by npm < 11.10, allowing dependency installs and version scripts to bypass the 7-day supply-chain cooldown. The engine floor makes the requirement explicit and enforced.

Test plan

• npm run check passes (biome, tsgo, installer render, browser smoke)
• Running npm version (11.17.0) satisfies the new constraint — no false block

Fixes #874

Note

Add npm >=11.10 engine constraint with strict enforcement

• Adds npm: '>=11.10' to the engines field in package.json to enforce the minimum npm version required for min-release-age support.
• Sets engine-strict=true in .npmrc so that npm install errors out when the engine constraints are not met.
• Risk: developers and CI using npm <11.10 will see install failures until they upgrade.

^{Macroscope summarized c7bd09d.}

[Copilot]

Pull request overview

This PR aims to ensure the repo’s min-release-age=7 supply-chain cooldown is not silently bypassed by older npm versions by declaring an npm version floor via engines in the root package.json.

Changes:

• Added "npm": ">=11.10" to the root package.json engines field.
• Documented the change in packages/coding-agent/CHANGELOG.md under [Unreleased].

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
package.json	Adds an npm engine constraint intended to surface a mismatch when using npm versions that don’t enforce min-release-age.
packages/coding-agent/CHANGELOG.md	Adds an Unreleased entry describing the new npm engine constraint and its motivation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Xsidz]

Good catch. Added engine-strict=true to .npmrc in the follow-up commit (0c2d1cc3) — this makes installs with npm < 11.10 fail outright rather than just warn, so the constraint is now a hard gate. Also updated the changelog wording to say "fail fast instead of silently ignoring" rather than "actually enforced".