Fix supply-chain policy findings

[jasverix]

Change summary

Fixes all 70 findings from the supply-chain check (supply-chain-safeguards.yml). Running the checker locally (same inventory step, Conftest 0.69.0, policy-v1, --fail-on-warn) gives 0 warnings and 0 failures. On main it gives 68 failures and 2 warnings.

Workflows

• Every action is pinned to a full commit SHA, with the tag kept as a comment. pnpm/action-setup@v2/v4 and softprops/action-gh-release@v1 are bumped as part of this.
• Storybook deploys: pnpm add -g firebase-tools is replaced by a firebase-tools devDependency and a deploy:hosting script. Both deploys now set CI=true.
• Releases use pnpm version / pnpm publish --no-git-checks instead of npm. The global npm install -g npm@11 steps are gone. Before publishing, pnpm pkg delete engines removes the repo-only engines field (npm disallowed, pnpm ≥ 11), so npm users of the libraries don't get engine warnings or errors.
• icons-create-version now sets up pnpm and runs the script with it.
• CI and the dev container now run on Node 24.

component-library

• pnpm-workspace.yaml: pmOnFail: error, strictDepBuilds, blockExoticSubdeps, minimumReleaseAge: 10080 + minimumReleaseAgeStrict, packageManagerStrictVersion, trustPolicy: no-downgrade.
• trustPolicyExclude: semver@6.3.1. It is the 6.x security backport, published without provenance just after 7.5.4 (which had it), and firebase-tools needs it through configstore > make-dir@3.
• protobufjs builds are denied. Its install script is only a version check.
• ignoredOptionalDependencies: [re2]. It is an optional native regex engine for firebase-tools' local server (superstatic), which falls back to RegExp. Deploys don't need it, and its unreviewed build script failed strictDepBuilds on Node 24.
• @types/node ^24. This also removes undici-types@6.21.0, which the trust policy rejected.

icons

• Moved from pnpm 9 to pnpm 11.23.0. A new icons/pnpm-workspace.yaml with the same settings also covers icons/vue. Engines are added to both package.json files.

Verified: frozen install passes every pnpm policy. CI on Node 24 is green: supply-chain check, component-library lint/typecheck, unit tests and build (incl. tree-shake check), and the icons build. pnpm publish --dry-run works for all three packages (run locally).

Watch on the first runs:

• Trusted publishing (OIDC) through pnpm publish couldn't be tested here. Try a *-release-dev run first.
• The Storybook deploy (pnpm run deploy:hosting) first runs on merge to main.
• Both scripts/version.cjs files still call npm version, because they parse its output. The checker doesn't scan them.

Change type

• No review
• Small PR
• Big PR
• Refactor

🤖 Generated with Claude Code

https://claude.ai/code/session_013yQykoHjiZEv15n8LWzUCQ