chore: bump pnpm and add package age gate

[prd-carapulse]

Summary

• Bumps pnpm configuration to 11.0.9.
• Adds a pnpm minimum package age of 3 days (minimumReleaseAge: 4320 / minimum-release-age=4320).

Maintainer checklist before merging pnpm v11

• Run installs with pnpm 11.0.9 from a clean checkout/cache; commit lockfile updates if pnpm v11 rewrites them.
• Run the repo’s normal lint, typecheck, test, and build commands.
• Check pnpm v11 config compatibility: v11 no longer reads pnpm settings from package.json#pnpm; migrate still-needed settings to pnpm-workspace.yaml.
• Review dependency build approvals: pnpm v11 defaults strictDepBuilds to true and replaces older build-script settings with allowBuilds; explicitly allow required build scripts and deny unnecessary ones.
• Confirm the 3-day package-age gate does not block required emergency/private packages; add narrow minimumReleaseAgeExclude entries only when justified.

Request Context

• Initiator: tarik (Slack; GitHub login unresolved)
• Initial Slack thread: Slack C0B3Z936HR6 thread 1778595495.930059
• Rationale: requested supply-chain hardening across active repos by pinning pnpm to v11 where applicable and enforcing a 3-day package-age gate where missing.

Verification

• Generated and syntax-checked JSON/TOML edits mechanically.
• Did not run repo-specific installs/tests in this batch; maintainers should complete the checklist before merging.