chore: enforce npm min-release-age dependency cooldown

[joker23]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Supply chain hardening for legacy SDK repositories, mirroring js-core's yarn npmMinimalAgeGate: 4320 (3 days).

Describe the solution you've provided

• Add .npmrc with min-release-age=3 (npm expresses this in days), so npm resolves only versions published more than 3 days ago. Unlike a Dependabot-level setting, this applies to every install — local development and CI alike.
• min-release-age-exclude explicitly names the first-party packages this repo actually resolves (launchdarkly-eventsource, launchdarkly-js-client-sdk, launchdarkly-js-sdk-common), so LaunchDarkly patches can be adopted immediately while third-party releases stay quarantined. Names are listed individually rather than pattern matched.

Describe alternatives you've considered

Dependabot cooldown — only governs Dependabot PRs, and these legacy repos aren't aiming to stay continuously updated.

Additional context

Verified locally with npm 12: npm install and the test suite pass with the gate active. CI is green.

Link to Devin session: https://app.devin.ai/sessions/566f0d951dfa4568b67ad0c6c1cfb7c1
Requested by: @joker23

---

Note

Low Risk
Configuration-only change with no application logic; install behavior may differ briefly if a needed third-party version is newer than three days.

Overview
Introduces a repository-level npm install gate (min-release-age=3) so dependency resolution prefers versions published more than three days ago, aligning with js-core’s yarn age gate for supply-chain hardening.

min-release-age-exclude lists launchdarkly-eventsource, launchdarkly-js-client-sdk, and launchdarkly-js-sdk-common so internal LaunchDarkly packages are not delayed; third-party releases remain subject to the cooldown on every npm install, including CI and local dev.

^{Reviewed by Cursor Bugbot for commit 025f634. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@cursor review

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.