mobile/ had no .npmrc, so unlike the root workspace it would resolve
packages published moments ago. #13113 surfaced this concretely: it
pulled nanoid 3.3.18 and postcss 8.5.26 at 0.4 and 1.7 days old, both
newer than anything the root gate would have allowed.
Copies the root's minimum-release-age=4320 (3 days). Deliberately not
shamefully-hoist -- that one is Electron-specific and would change how
mobile hoists.
Re-resolves nanoid to 3.3.17 and postcss to 8.5.25 in the same commit
because the gate is otherwise unusable: pnpm install fails with
ERR_PNPM_NO_MATCHING_VERSION on the locked nanoid 3.3.18. Both picks stay
above their advisory floors (CVE-2026-67213 needs >=3.3.17,
CVE-2026-69153 needs >=8.5.23), so this is not a security regression.
Co-authored-by: Orca <help@stably.ai>
