[github-maintenance] Fix pnpm-workspace.yaml configuration (#9515)

Fixes misconfigured fields in `pnpm-workspace.yaml`.

See the tracking issue in github-maintenance.

<!-- github-maintenance:hash=94062f67:script=pnpm-workspace-check -->

---------

Co-authored-by: marimo-github-maintenance-bot[bot] <267743655+marimo-github-maintenance-bot[bot]@users.noreply.github.com>
Co-authored-by: Myles Scolnick <myles@marimo.io>

Author: marimo-github-maintenance-bot[bot]

.github/workflows/test_fe.yaml

@@ -30,6 +30,7 @@ jobs:
             frontend:
               - 'frontend/**'
               - 'packages/**'
+              - 'pnpm-workspace.yaml'
 
   lint_frontend:
     needs: changes

pnpm-workspace.yaml

@@ -2,18 +2,28 @@ verifyDepsBeforeRun: install
 packages:
   - frontend
   - packages/*
-minimumReleaseAge: 10080
+minimumReleaseAge: 20160
 minimumReleaseAgeExclude:
   - "@marimo-team/*"
-  # Renovate security update: yaml@2.8.3
   - yaml@2.8.3
-  # Renovate security update: path-to-regexp@8.4.0
   - path-to-regexp@8.4.0
   - oxlint@1.58.0
   - "@oxlint/*"
-  # Renovate security update: lodash-es@4.18.1
   - lodash-es@4.18.1
-  # Renovate security update: dompurify@3.4.0
   - dompurify@3.4.0
-  # Renovate security update: postcss@8.5.10
   - postcss@8.5.10
+blockExoticSubdeps: true
+trustPolicy: no-downgrade
+trustPolicyExclude:
+  # Transitive/direct deps where the resolved version lacks SLSA provenance
+  # but an earlier-published version had it. Verified no known takeovers as
+  # of 2026-05-12 — these are publishing-pipeline changes, not incidents.
+  - "@octokit/endpoint@9.0.6"
+  - "@octokit/plugin-paginate-rest@9.2.2"
+  - "@swc/core@1.12.14"
+  - "@textea/json-viewer@4.0.1"
+  - "chokidar@4.0.3"
+  - "semver@5.7.2 || 6.3.1"
+  - "tailwind-merge@2.6.0"
+  - "undici@5.29.0"
+  - "undici-types@6.21.0"