chore(ci): add --ignore-scripts to release installs

[mscolnick]

Defense-in-depth against compromised transitive deps executing postinstall/prepare during release. Motivated by the TanStack npm supply-chain compromise (May 2026).

No functional change.

[Copilot]

Pull request overview

This PR hardens the GitHub Actions release workflow by adding pnpm install --ignore-scripts to reduce the risk of compromised dependencies running lifecycle scripts during the release process.

Changes:

• Add --ignore-scripts when globally installing npm@latest in the release workflow.
• Add --ignore-scripts to the main dependency install step in the release workflow.

Comments suppressed due to low confidence (1)

.github/workflows/release.yml:40

• pnpm install --ignore-scripts will skip Playwright’s install hooks. Since pnpm run test runs a Vitest browser project (see vite.config.ts), the release workflow likely needs an explicit pnpm exec playwright install chromium step (as done in .github/workflows/test.yml) or otherwise ensure browser tests are disabled in release; otherwise the release job may fail due to missing browsers.

      - name: 📥 Install dependencies
        run: pnpm install --ignore-scripts --frozen-lockfile

      - name: 🔍 Type Check
        run: pnpm run typecheck

      - name: 🧪 Test
        run: pnpm run test

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mscolnick]

This is already covered by pnpm 10 — closing.