feat: add dependency-cooldown

[dewabisma]

Summary

Added workflow that check direct and transitive dependencies age

[n13]

Reviewer model: GPT Sol

Verdict: REQUEST_CHANGES — the scheduled audit cannot complete on this repository, and the pull-request check is not configured as a required merge gate.

Findings:

• High — Require the cooldown status on main. .github/workflows/dependency-cooldown.yml:13 creates dependency-cooldown / Dependency cooldown, but the effective rules for main contain only deletion, non-fast-forward, and one-approval pull-request rules; neither the ruleset nor branch protection has a required-status-check rule. A dependency PR can therefore still be merged when this security check fails. Add the cooldown job as a required status check in the active main ruleset before treating the gate as enforced.

• High — Fix the scheduled audit's handling of the existing local tarball. .github/workflows/dependency-cooldown-audit.yml:12 invokes the current shared-workflows@v1 audit over all locked versions. On this exact head, bun.lock:1522 records human-readable-checksum@./package/human-readable-checksum-0.3.0.tgz; the Bun parser does not recognize the relative tarball specifier as non-registry, queries https://registry.npmjs.org/human-readable-checksum, receives HTTP 404, and exits 2. As a result, every weekly or manual audit will fail before producing the intended age report. Fix and publish the shared parser so relative/local archive specs are reported as uncheckable, or omit this audit caller until that fix is available.

Validation:

• Reviewed the full diff from c66e017422ad7f395c84a0935fb4e90c567e66f7 to 116f08befddf92df6347d6d87df833c6a3858889; git diff --check passed.
• actionlint passed for both new workflow files.
• The live Build and Test and pull-request cooldown jobs pass; the shared action's check mode also passed locally with zero introduced versions.
• The shared action's audit mode scanned 1,500 locked versions and reproduced the npm 404/exit-2 failure above.