fix: harden package manager config

[zeitlinger]

Summary

Draft canary PR generated from the security-hardening skill prototype in grafana/ai-kit#585.

This applies deterministic safe npm hardening for package roots where npm is unambiguous from the existing lockfile:

• packageManager: "npm@11.16.0" — exact pin to the npm registry latest dist-tag checked on 2026-05-28
• ignore-scripts=true
• save-exact=true
• allow-git=none
• min-release-age=3

Validation

• Ran security_hardening.py fix --modules package-management --safe-only --apply
• Re-ran security_hardening.py detect --modules package-management
• Confirmed there are 0 remaining package-management findings in this canary checkout

Notes

This intentionally does not migrate npm to pnpm. pnpm may be a valid stronger hardening path, but it changes lockfiles/install commands and should be a separate owner-reviewed migration.

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}