Harden the organization check install

[silveltman]

Hardens the install in the organization Check workflow that the Merge policy ruleset requires on every pull request.

Rebased on main after #3 (checkout and setup-node 7) merged.

What changes

• Install always runs. Before, a cache hit restored node_modules and skipped pnpm install, so a run never checked the lockfile against the repository's pnpm settings or the registry. Now only the pnpm store (downloaded packages) is cached, keyed on pnpm-lock.yaml, and pnpm install --frozen-lockfile runs every time. That is where trustPolicy, the strict release age and ignorePnpmfile from the per-repository PRs are enforced.
• --ignore-pnpmfile added to the install, and pnpm_config_ignore_scripts / pnpm_config_ignore_pnpmfile set for the job, so installs started from a check script get the same protection. Explicit pnpm run scripts still run.
• Actions pinned to commit SHAs with the version in a comment: actions/checkout v7.0.1 and actions/setup-node v7.0.0 (the current v7 tags, as Use checkout and setup-node 7 in the check workflow #3 set), actions/cache v6.1.0 (the current v6 tag).
• Permissions stay as they were: contents: read for the check, write only on the CloudCannon auto-merge job, which is unchanged.

Testing

• actionlint 1.7.12 and Prettier pass.
• pnpm store path --silent prints only the store path on pnpm 11.28.0 and 12.8.1.
• pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile with pnpm 12.8.1, the version all 43 repositories now pin, passes on each repository's security PR rebased on current main.
• Not tested end to end: the ruleset runs this workflow from this repository's main, so other repositories only use it after merge. This PR's own Check finds no package and exits with the "nothing to run" notice, so it does not exercise the new steps. Watch the first PRs after merging.

Risks

• Merge order with the repository PRs does not matter: without a repository's security PR the install uses pnpm defaults, and with it the frozen install was tested to pass.
• A run without a warm store downloads all packages; later runs restore the store. Expect slightly slower checks than a node_modules cache hit, in exchange for a verified install.

🤖 Generated with Claude Code