chore: enforce npm min-release-age dependency cooldown

[joker23]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Supply chain hardening for legacy SDK repositories, mirroring js-core's yarn npmMinimalAgeGate: 4320 (3 days).

Describe the solution you've provided

• Add .npmrc with min-release-age=3 (npm expresses this in days), so npm resolves only versions published more than 3 days ago. Unlike a Dependabot-level setting, this applies to every install — local development and CI alike.
• min-release-age-exclude explicitly names the first-party packages this repo actually resolves (launchdarkly-js-sdk-common), so LaunchDarkly patches can be adopted immediately while third-party releases stay quarantined. Names are listed individually rather than pattern matched.
• CI installs npm@^11.17.0 before npm install — min-release-age-exclude landed in npm 11.17.0, and the node 22 matrix entry bundles npm 10. The release workflow needs no change: node 24.x already bundles 11.17.0, so its Update NPM step is removed.

Describe alternatives you've considered

Dependabot cooldown — only governs Dependabot PRs, and these legacy repos aren't aiming to stay continuously updated.

Additional context

Verified locally with npm 11.17.0: the gate blocks non-exempt packages, the exclude list is honored, and npm install plus the test suite pass.

Link to Devin session: https://app.devin.ai/sessions/566f0d951dfa4568b67ad0c6c1cfb7c1
Requested by: @joker23

---

Note

Overview
Introduces supply-chain hardening by adding .npmrc with min-release-age=3, so npm only resolves package versions published more than three days ago for every install (local and CI). launchdarkly-js-sdk-common is listed in min-release-age-exclude[] so first-party LaunchDarkly packages can still be picked up immediately.

CI matrix replaces Node 18 with ^24.19.0 alongside latest. Release and manual publish workflows pin Node to ^24.19.0 (was 24.x) and remove the global npm install -g npm@11.6.2 step, relying on the Node-bundled npm that supports the new .npmrc options.

^{Reviewed by Cursor Bugbot for commit abe9b56. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@cursor review

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.