chore: harden supply-chain security for yarn-based monorepo

[akudev]

Add layered defenses against dependency supply-chain attacks:

• .yarnrc: enforce frozen-lockfile, pin exact versions on add, and lock registry to yarnpkg.com
• renovate.json: 7-day minimumReleaseAge, pin strategy, weekly lockfile maintenance
• lockfile-lint: validate yarn.lock resolved URLs point to the expected registry (guards against lockfile poisoning in PRs)
• Pin all dependency ranges in dts-generator to exact versions resolved from the current lockfile, including replacing dangerous "latest" specifiers
• Regenerate yarn.lock to match the newly pinned specifiers
• CI workflows: add --frozen-lockfile to all yarn invocations (prevents non-deterministic installs); update GH Actions SHA comments from major-only (# v4) to specific version (# v4.3.1)

Yarn Classic lacks npm's allow-git and min-release-age settings entirely, so Renovate's minimumReleaseAge + frozen-lockfile + code review are the compensating controls.

[Copilot]

Pull request overview

This PR hardens the monorepo’s Yarn-based dependency supply chain by tightening version pinning, adding lockfile integrity checks, and making CI installs deterministic.

Changes:

• Add Renovate configuration to gate updates by release age, pin dependency ranges, and perform scheduled lockfile maintenance.
• Pin packages/dts-generator dependencies to exact versions and regenerate yarn.lock accordingly.
• Add lockfile host validation via lockfile-lint, add .yarnrc defaults, and enforce --frozen-lockfile in GitHub Actions workflows.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
yarn.lock	Updates lockfile entries to reflect pinned specifiers and adds new deps for lockfile linting.
renovate.json	Introduces Renovate policy for minimum release age, pinning, grouping, and maintenance.
packages/dts-generator/package.json	Replaces range/latest specifiers with exact versions for safer, deterministic installs.
package.json	Adds lockfile-lint dependency and runs lockfile validation as part of ci.
.yarnrc	Sets defaults to pin added dependencies, configure registry, and attempt to enforce frozen lockfile installs.
.github/workflows/release.yml	Uses yarn --frozen-lockfile and updates pinned action version comments.
.github/workflows/commitlint.yml	Updates pinned action version comments.
.github/workflows/codeql-analysis.yml	Updates pinned action version comments.
.github/workflows/ci.yml	Uses yarn --frozen-lockfile and updates pinned action version comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.