fix(ci): pin Dependabot npm registry

[vincentkoc]

Summary

• Pin npm automation to the public npm registry in .npmrc.
• Add an Unreleased changelog note for the automation fix.

Validation

• pnpm config get registry -> https://registry.npmjs.org/
• git diff --check

Impact

Prevents Dependabot/pnpm from resolving public scoped packages such as @types/node through GitHub Packages, which caused the dynamic Dependabot update job to fail.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(ci): pin Dependabot npm registry This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.