Harden npm supply chain

[a-github-name]

Summary

• remove Ink/React runtime renderer dependencies and keep interactive onboarding on a local terminal renderer
• exact-pin direct deps, add a runtime npm shrinkwrap, and enforce supply-chain checks plus lifecycle-script review
• add scheduled npm audit/signature workflow and publish provenance/ignore-scripts hardening

Verification

• pnpm verify
• pnpm docs:build
• pnpm test:pack
• npm pack --dry-run --ignore-scripts --json
• npm audit --audit-level=moderate --omit=dev --package-lock-only --ignore-scripts
• npm audit signatures --package-lock-only --ignore-scripts
• clean temp-copy pnpm install --frozen-lockfile
• MERE_ALLOW_LOCKFILE_CHANGE=1 pnpm check:lockfile-guard
• pnpm check:supply-chain
• git diff --check / git diff --cached --check