chore: enforce npm min-release-age dependency cooldown

[joker23]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Supply chain hardening for legacy SDK repositories, mirroring js-core's yarn npmMinimalAgeGate: 4320 (3 days).

Describe the solution you've provided

• Add .npmrc with min-release-age=3 (npm expresses this in days), so npm resolves only versions published more than 3 days ago. Unlike a Dependabot-level setting, this applies to every install — local development and CI alike.
• min-release-age-exclude explicitly names the first-party packages this repo actually resolves (launchdarkly-js-client-sdk and its transitive launchdarkly-js-sdk-common), so LaunchDarkly patches can be adopted immediately while third-party releases stay quarantined. Names are listed individually rather than pattern matched.
• .npmrc is un-ignored so the setting is committed; publishing is unaffected because setup-node writes its auth .npmrc to a temp NPM_CONFIG_USERCONFIG path, not into the repo.
• CI and the release workflow install npm@^12.0.0 before npm install, so the gate applies to both PR builds and published releases. min-release-age-exclude needs npm 12, which requires node >=22.22, so the older CI matrix entry is raised to node 22.

Describe alternatives you've considered

Dependabot cooldown — only governs Dependabot PRs, and these legacy repos aren't aiming to stay continuously updated.

Additional context

Verified locally with npm 12: npm install and the test suite pass with the gate active. CI is green.

Link to Devin session: https://app.devin.ai/sessions/566f0d951dfa4568b67ad0c6c1cfb7c1
Requested by: @joker23

---

Note

Low Risk
Workflow and install-policy changes only; no application runtime logic. Slightly delays adoption of very new third-party releases by design.

Overview
Adds supply-chain hardening so installs only resolve npm package versions published more than 3 days ago, aligned with js-core’s dependency cooldown.

A committed .npmrc sets min-release-age=3 and exempts launchdarkly-js-client-sdk and launchdarkly-js-sdk-common so first-party LaunchDarkly packages can still update immediately. .npmrc is removed from .gitignore so the policy applies in local dev and CI.

CI pins the matrix to Node 22 (replacing lts/*) and installs npm@^12 before npm install, since min-release-age-exclude needs npm 12. Release workflows likewise upgrade global npm from 11.6.2 to npm@^12.0.0 before dependency install and publish.

^{Reviewed by Cursor Bugbot for commit 5c891d8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@cursor review