Wire frontend/react-native-expo for pnpm 11 (config only; lockfile follow-up)

[Gabrielpanga]

Summary

Draft. Config-only bump for `frontend/react-native-expo`. This PR sets up the pnpm 11 metadata + supply-chain hardening but does not run `pnpm install` — the `pnpm-lock.yaml` and the removal of the old `package-lock.json` / `.npmrc` need to happen on a machine that can actually install (Expo pulls native deps that may need their own postinstall decisions).

What's in this PR

`package.json`

• `packageManager: pnpm@11.1.1`
• `engines: { node: >=24.0.0, pnpm: >=11.0.0 }`
• `devEngines.runtime` with `onFail: error`
• `scripts.preinstall: pnpm audit && pnpm audit signatures`
• `scripts.lint:lockfile: pnpm install --frozen-lockfile`
• `scripts.typecheck / lint / test / build` → `tsc --noEmit` (was `expo lint`, which errors out interactively without an eslint config; typecheck is the safe baseline for now)

`pnpm-workspace.yaml` — full supply-chain stack:

• `minimumReleaseAge: 20160` (14d)
• `minimumReleaseAgeIgnoreMissingTime: true`
• `minimumReleaseAgeExclude: ['@pluggyai/*']`
• `engineStrict: true`
• `trustPolicy: no-downgrade`, `trustPolicyIgnoreAfter: 129600` (90d)
• `blockExoticSubdeps: true`
• `savePrefix: ""`
• `resolutionMode: highest`
• `allowBuilds: {}` — to be populated on first `pnpm install` (Expo ships native deps like `react-native-reanimated` with postinstall scripts; each one needs an explicit yes/no decision)
• `overrides: {}`

`.gitignore` — adds `package-lock.json` and `yarn.lock`.

Follow-up required before merging

1. Run `pnpm install` to generate `pnpm-lock.yaml`.
2. Delete the now-stale `.npmrc` and `package-lock.json`.
3. Populate `allowBuilds` in `pnpm-workspace.yaml` with conscious yes/no decisions for each native dep that asks for a postinstall (default-deny per repo policy).
4. Re-run audit; resolve anything that surfaces with `overrides` / `minimumReleaseAgeExclude` entries as in Migrate frontend/nextjs to pnpm 11 with supply-chain hardening #38–Add CI + bring vercel-node-mongo pnpm setup up to repo standard #45.
5. Add `.github/workflows/expo-ci.yml` matching the other per-project workflows.