Add npm min-release-age cooldown for supply chain protection

[NicolasBonet]

Details

• Adds a 7-day npm install cooldown (min-release-age=7) so freshly published, possibly malicious package versions are not resolved; npm ci and lockfile-clean installs are unaffected.
• No exclusions: this repo installs no Expensify-published package from the registry. .npmrc is also removed from .gitignore so the config can be committed; publishing uses OIDC trusted publishing, so no token file is ever written there.

Design doc: https://expensify.enterprise.slack.com/docs/T03SC9DTT/F0BNG8W2FML

Related Issues

https://github.com/Expensify/Expensify/issues/636594

Manual Tests

Tooling-only change, no library code affected. Existing CI npm ci covers the no-op case.

1. Run nvm use and confirm npm --version prints 11.17.0.
2. Run npm config get min-release-age from the repo root and confirm it prints 7.
3. Run npm ci and confirm it installs the lockfile contents without errors.
4. Run npm install @types/node@latest --dry-run and confirm npm resolves a version published at least 7 days ago (currently 22.20.1, not the fresh 22.20.3).
5. Run npm install @types/node@latest --dry-run --min-release-age=0 and confirm npm resolves the fresh version, showing the bypass works.

Linked PRs

None. No package version changes.