chore(yarn): enable hardened mode and supply-chain settings

Extend .yarnrc.yml with the conservative hardening tier:

- enableHardenedMode: strict checksum + integrity validation on the
  resolver; rejects any tampering with the lockfile or registry.
- npmMinimalAgeGate: 3d -- refuses to install npm packages younger
  than three days, mitigating the typical supply-chain "install a
  malicious 0.0.1-published-an-hour-ago" window.
- enableGlobalCache + nmMode: hardlinks-global -- shares package
  content across worktrees via the global cache and hardlinks,
  reducing duplicate on-disk content and speeding repeat installs.
- enableTelemetry: false -- explicit opt-out from Yarn telemetry.

Install scripts stay enabled in this commit; the
`enableScripts: false` + per-package allowlist follows next so the
two changes can be reverted independently if needed.

Verified `yarn install --immutable` is clean under the new
settings.

Author: oliverlaz

.yarnrc.yml

@@ -1,12 +1,22 @@
 approvedGitRepositories:
   - "**"
 
+enableGlobalCache: true
+
+enableHardenedMode: true
+
 enableScripts: true
 
+enableTelemetry: false
+
 nmHoistingLimits: workspaces
 
+nmMode: hardlinks-global
+
 nodeLinker: node-modules
 
+npmMinimalAgeGate: 3d
+
 npmPublishProvenance: true
 
 yarnPath: .yarn/releases/yarn-4.14.1.cjs