chore(deps): enforce install-script policy

[KyleJune]

Summary

Juniper's install-script permissions named an unused esbuild version in allow and omitted resolved script-bearing versions. Deny all three resolved esbuild versions and the macOS-only fsevents package, with no install scripts allowed.

Changes

• Remove the stale esbuild allow entry and obsolete watcher/less denials.
• Port the existing install-script drift checker and its fixture-based tests. It rejects stale entries and installed lifecycle scripts without a decision, and fails closed when the store is missing or unreadable.
• Run the gate and its tests through deno task check and after frozen installation on Linux, macOS, and Windows CI. Platform-specific scripts are checked where installed.

Testing

The new gate rejected the original policy with the reported stale allow and uncovered esbuild versions, then passed after correction. Frozen installation, full checks, 43 package tests (480 steps), 15 gate test steps, and real minimal/Tailwind production builds passed locally. The lockfile is unchanged.

Closes

Closes #128

[github-actions]

🎉 This PR is included in version 0.12.1 🎉

The release is available on:

• JSR.io
• GitHub release

Your semantic-release bot 📦🚀