build(security): stop running dependency lifecycle scripts on install

[hivecommons-hive]

Security Fix

Closes #1316

A bare npm ci runs preinstall/install/postinstall from every package in
the tree — 1490 installed, 1557 lockfile entries — as arbitrary code on the
runner. Eleven call sites across ten workflows do exactly that, and four sit in
jobs holding a write-scoped GITHUB_TOKEN:

workflow	permissions
architecture-submission.yml	contents: write, pull-requests: write, issues: write
import-architectures.yml	contents: write, pull-requests: write
pr-queue-hygiene.yml	pull-requests: write, issues: write
create-milestones.yml	issues: write, pull-requests: write

Those scripts run before any validator, test or lint step, so a single
compromised transitive dependency gets code execution next to a token that
pushes branches and opens pull requests, and can rewrite the node_modules the
later steps load. SHA-pinned actions, an integrity-complete lockfile and
persist-credentials: false do not cover this — none of them stop a lifecycle
script inside a package the lockfile resolves faithfully.

What this changes

• .npmrc (new): ignore-scripts=true, with a comment recording why and
  what was checked. One file covers all eleven npm ci call sites and local
  installs, and needs no workflows permission to land.
• CONTRIBUTING.md: one paragraph in Development setup so a contributor
  who hits a dependency that wants an install script raises it in review rather
  than quietly deleting the setting.

Scope claimed: .npmrc, and the Development setup section of
CONTRIBUTING.md. No .github/workflows/** file is touched, so this is
disjoint from #1309 (codeql.yml language set) and #1310 (automation-workflow
concurrency: groups).

Why nothing breaks

package.json declares no lifecycle hooks, and only three dependencies declare
an install script, none load-bearing:

• @swc/core — postinstall emits an advisory warning only; the native binding
  ships prebuilt in @swc/core-linux-x64-gnu, which declares no install script.
• core-js — postinstall prints a funding banner.
• fsevents — macOS-only and optional; chokidar falls back without it.

Verified at cc447d8: with the file in place, npm ci resolves all 1490
packages and npm run build reports [SUCCESS] Generated static files in "build". npm run test:unit gives a byte-identical pass/fail split with and
without the file (72 files failing in the review sandbox for an unrelated
pre-existing reason — Node v26 against the declared node: 22.x), so this moves
no test either way.

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "sec-check" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.