[TheGreatAxios]

Closes CL-11847 (https://linear.app/abklabs/issue/CL-11847/fail-the-checks-on-any-dependency-not-pinned-to-an-exact-version).

Changes

• scripts/verify-pins.ts: reads every tracked package.json outside vendor/.
  • Fails, naming the file and package@version, on:
    • ^, ~, ranges, wildcards, tags or latest
    • file: or link:
    • a git dependency without a full commit sha
    • a non-git URL
    • no tracked manifests at all
  • Reads: dependencies, dev, peer and optional dependencies, catalog and catalogs (at the top level and under workspaces), overrides and resolutions.
  • Passes: exact versions, exact npm: aliases, workspace:, catalog: references and override $ references.
• Wiring: bun run check runs it as pins:verify, and CI runs it as its own job.

Verification

• bun run pins:verify passes on all 14 manifests.
• Run against a scratch repo:
  • Reported: ^ in a workspaces catalog, ^ in resolutions, a sha-suffixed tarball URL and npm:pkg@^1.
  • Passed: npm:pkg@1.2.3, workspace:^ and a sha-pinned .git URL. A my-package.json was ignored.
• An independent review's findings are fixed; uppercase shas and +build metadata are deliberately left unsupported.
• Lint and typecheck pass.

[linear-code]

CL-11847

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Notes:

• changes sensitive paths: ci: .github/workflows/ci.yml

Triage will approve.