ci: install the committed lockfile without the release-age cooldown

The composite setup action enforced the minimumReleaseAge cooldown on every CI
install, so runs failed on daily-churning transitive deps (electron-to-chromium,
baseline-browser-mapping, @FortAwesome, expect-type, ...) younger than 3 days.
The cooldown vets new deps at resolution time (locally, when they enter the
lockfile); CI installs that already-vetted lockfile, so it is skipped here via
`pnpm install --frozen-lockfile --config.minimumReleaseAge=0`.

Author: muuvmuuv

.github/actions/setup/action.yml

@@ -14,4 +14,9 @@ runs:
       uses: pnpm/action-setup@v6
       with:
         version: 11
-        run_install: true
+
+    - name: Install dependencies
+      shell: bash
+      # CI installs the already-vetted committed lockfile, so skip the release-age
+      # cooldown here (it gates new deps at resolution time, locally).
+      run: pnpm install --frozen-lockfile --config.minimumReleaseAge=0