fix: enforce min-release-age=7 via 1st-party tooling (drop wrapper)

.github/dependabot.yml

@@ -1,9 +1,18 @@
 version: 2
 updates:
+  # Supply-chain defense: minimum 7-day cooldown before Dependabot opens
+  # a version-bump PR. Matches `.npmrc` `min-release-age=7` and the
+  # cargo audit `min-age` policy. Security updates bypass cooldown by
+  # default (Dependabot's `security-updates`-first behavior).
+  # When RFC 3923 (`-Zmin-publish-age`) stabilizes on Rust stable
+  # (~1.98+), the cargo ecosystem can drop to native enforcement
+  # and `cooldown` can be relaxed. Tracking: see sqlpilot issue.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     labels:
       - "dependencies"
       - "github-actions"
@@ -12,6 +21,8 @@ updates:
     directory: "/src-tauri"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     labels:
       - "dependencies"
       - "rust"
@@ -25,6 +36,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     labels:
       - "dependencies"
       - "javascript"
@@ -33,7 +46,3 @@ updates:
       npm:
         patterns:
           - "*"
-
-# Minimum package age is enforced by the CI `deps-age` job
-# (scripts/check-deps.mjs). Dependabot PRs that bump packages younger
-# than 7 days will fail CI and cannot be merged.

.github/workflows/ci.yml

@@ -133,23 +133,6 @@ jobs:
           fi
           echo "All versions match: $jsver"
 
-  deps-age:
-    name: Dependency Age Gate
-    needs: detect-changes
-    if: needs.detect-changes.outputs.npm == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # v1.0.0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: '20'
-          cache: 'npm'
-      - name: Install npm dependencies (for lockfile resolution)
-        run: npm ci
-      - name: Check dependency ages
-        run: npm run deps:check
-
   lint-ts:
     name: Lint (TypeScript)
     needs: detect-changes

.npmrc

@@ -1,4 +1,4 @@
 # Security
 audit-level=critical
-min-release-age=2
+min-release-age=7
 package-lock=true

package.json

@@ -13,8 +13,7 @@
     "type-check": "tsc --noEmit",
     "test:unit": "vitest run",
     "test:unit:watch": "vitest",
-    "test:e2e": "playwright test",
-    "deps:check": "node scripts/check-deps.mjs"
+    "test:e2e": "playwright test"
   },
   "dependencies": {
     "@monaco-editor/react": "^4.7.0",