WEB-32: harden CI and release gates

[JS-mark]

Summary

• make pnpm check the shared local, CI, and release quality gate
• hash complete package inputs in Turborepo and reject empty CLI test suites
• pin GitHub Actions to immutable commits and install the exact pnpm version from packageManager
• add a high-severity production dependency audit and refresh vulnerable transitive dependencies
• make the Changesets and release checklist version-independent and document manual configuration

Verification

• Node 24.19.0: forced build, test, typecheck, and lint run — 30/30 tasks passed
• pnpm install --frozen-lockfile
• pnpm audit:prod — 0 high vulnerabilities
• cache invalidation probes for docs build and test-file typecheck inputs
• pnpm changeset status --since=origin/main
• npm pack --dry-run --json for all six publishable packages
• GitHub Actions YAML and repository JSON parsing

Closes WEB-32