feat: centralize package quarantine policy (#35)

* feat: adopt shared quarantine policy

* fix: restrict quarantine pruning to schedules

* fix: enforce quarantine lockfile ingress

Author: jan-kubica

.github/workflows/quarantine-policy.yml

@@ -0,0 +1,16 @@
+name: Package quarantine policy
+
+on:
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+jobs:
+  enforce:
+    name: Enforce package quarantine
+    if: github.repository == 'stella/tooling'
+    permissions:
+      contents: read
+    uses: stella/.github/.github/workflows/quarantine-policy.yml@699affd63b2d956f71b9833fbed239245aff7e86

.github/workflows/quarantine-prune.yml

@@ -0,0 +1,19 @@
+name: Package quarantine prune
+
+on:
+  schedule:
+    - cron: "37 * * * *"
+
+permissions:
+  contents: read
+
+jobs:
+  prune:
+    name: Remove expired quarantine exceptions
+    if: github.repository == 'stella/tooling'
+    permissions:
+      contents: read
+    uses: stella/.github/.github/workflows/quarantine-prune.yml@699affd63b2d956f71b9833fbed239245aff7e86
+    secrets:
+      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

bunfig.toml

@@ -1,6 +1,4 @@
 [install]
 # 5-day quarantine: reject fresh package versions to reduce supply-chain risk.
 minimumReleaseAge = 432_000
-minimumReleaseAgeExcludes = [
-  "bun-types@1.4.0", # quarantine-expires: 2026-08-25T14:11:33.785Z
-]
+minimumReleaseAgeExcludes = []