Replaces every mutable workflow reference (@main, @v1, @V3, @v4,
@v6.0.2) with a 40-char commit SHA + version comment so Renovate can
keep them current. Composite actions in TanStack/config — previously
pinned to @main — are the highest-impact change: a force-push or
compromised commit there would have given an attacker the npm OIDC
publishing identity plus contents/issues/PR write tokens on the next
push to main.

Other changes in this commit:

- release.yml: set cancel-in-progress: false so a re-push cannot abort
  changesets/action mid-publish and leave partial versions on npm.
  Add environment: release so required reviewers can be configured in
  repo settings for an explicit human gate before publish.

- triage-agent.yml: add a "SECURITY: Untrusted input" preamble to the
  Warp agent prompt. The agent reads attacker-controlled issue text,
  so it must treat that text strictly as data and refuse instructions
  embedded inside it. Also corrected the bug-report template path
  (bug-report.yml -> bug_report.yml) that the agent was failing to
  load.

- check-skills.yml / validate-skills.yml: pin @tanstack/intent to a
  specific version; npm install -g without a version was floating.

- pr.yml preview job: pin pkg-pr-new to a specific version; pnpx
  without a version was floating.

- .github/renovate.json: drop :automergeMinor. Combined with floating
  versions this could have landed a malicious patch without review.

- .github/CODEOWNERS (new): require owner review on workflows, package
  manifests, lockfile, .npmrc, and renovate config. Adjust the owner
  handle to a team once one exists.

- .github/workflows/dependency-review.yml (new): runs
  actions/dependency-review-action on every PR with
  fail-on-severity: high to block PRs that introduce known-vulnerable
  transitive dependencies.

The original `||`-chained preinstall printed "Skipping preinstall..." in
CI but then ran only-allow anyway because `process.exit(1)` triggers
the `||` operator. CI happened to pass when only-allow was unpinned
(npx resolved it differently), but pinning to @1.2.2 forced a fresh
registry resolve in which only-allow strictly checks
npm_config_user_agent — which, when invoked via npx-inside-pnpm, is
npm's, not pnpm's — and rejects.

The fix matches the script's stated intent: when CI=true, exit 0 so
the `||` does not trigger and only-allow is genuinely skipped. Local
installs continue to fall through and enforce pnpm via only-allow as
before.