chore: route npm installs through Takumi Guard

[saitota]

Background

PR #1567 added a cooldown to reduce exposure to newly published supply-chain attacks, but malicious packages can still remain after the cooldown window. Takumi Guard is an npm registry proxy that checks packages against a threat database and blocks known-malicious packages before they are installed.

References

• Cooldown PR: chore(security): add cooldown for supply chain protection #1567
• Takumi Guard GitHub Action: https://github.com/flatt-security/setup-takumi-guard-npm#readme
• Takumi Guard npm quickstart: https://shisho.dev/docs/t/guard/quickstart/npm/

Verification

• Ran pinact run.
• Ran pnpm run cicheck:code && pnpm run cicheck:content.
• Ran pnpm run check.
• Ran pnpm run test.
• Confirmed the updated GitHub Actions jobs on this PR.
• Confirmed bun install through Takumi Guard in CI.
• Confirmed the release publish workflow after merge.

[dyoshikawa]

@saitota Thank you!