Harden npm install defaults (#401)

CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Add `.npmrc` defaults that disable those
scripts and apply the same seven-day `min-release-age` policy used by
`setup-uv`. Require npm `11.10.0` or newer through `devEngines` so older
versions cannot silently ignore the age setting. Explicit project
commands such as `npm run package` remain available.

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

.npmrc

@@ -0,0 +1,2 @@
+ignore-scripts = true
+min-release-age = 7

package.json

@@ -5,6 +5,13 @@
   "type": "module",
   "description": "A GitHub Action to run Ruff, an extremely fast Python linter and code formatter.",
   "main": "dist/ruff-action/index.cjs",
+  "devEngines": {
+    "packageManager": {
+      "name": "npm",
+      "version": ">=11.10.0",
+      "onFail": "error"
+    }
+  },
   "scripts": {
     "build": "tsc --noEmit",
     "check": "biome check --write",