pnpm supply-chain settings belong in pnpm-workspace.yaml, not .npmrc, wrong location is silently ignored

pnpm moved per-workspace supply-chain controls (minimumReleaseAge, minimumReleaseAgeExclude, onlyBuiltDependencies) out of .npmrc into pnpm-workspace.yaml and the global config.yaml. Settings placed in .npmrc are silently accepted and never applied, so the cooldown protection looks configured but isn't. People migrating from npm or yarn habits hit this consistently.

Put pnpm supply-chain controls in pnpm-workspace.yaml (workspace-level) or pnpm's global config.yaml, never .npmrc. Verify by attempting to install something published within the cooldown window and confirming it gets blocked. Cross-check the current settings location against pnpm.io/settings because pnpm has reshuffled config layout in recent majors.