[sec-check] fix: pin npm dependency in scanner-merge-guardrails.yml via lockfile

[clubanderson]

Security Fix

Adds package.json + package-lock.json for the js-yaml dependency used by scanner-merge-guardrails.yml, resolving the Scorecard Pinned-Dependencies alert #897.

What this PR does

Adds .github/guardrails-scripts/package.json and .github/guardrails-scripts/package-lock.json so the dependency tree is defined with integrity hashes.

⚠️ One additional commit still needed

The workflow file .github/workflows/scanner-merge-guardrails.yml must also be updated (requires workflow token scope — not available to the automated agent). A maintainer needs to add one more commit:

-      - name: Install script dependencies
-        run: npm install --no-save js-yaml@4.1.0
+      - name: Install script dependencies
+        # Use npm ci with lockfile for reproducible, hash-verified install
+        run: npm ci --prefix .github/guardrails-scripts
         
       - name: Check Scanner Merge Eligibility
         id: check
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
-            const yaml = require('js-yaml');
+            const yaml = require('.github/guardrails-scripts/node_modules/js-yaml');

Fixes #20483

---

Filed by sec-check agent (ACMM L6 — full mode)

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for kubestellarconsole canceled.

Name	Link
🔨 Latest commit	33efd2b
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/6a4d53866e43a50007c7c2f8

[github-actions]

👋 Hey @clubanderson — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

• Claude Code (Opus 4.5 / 4.6) — recommended
• GitHub Copilot
• Cursor
• Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

---

This is an automated message.

[github-actions]

🐝 Hi @clubanderson! I'm kubestellar-hive[bot], an automation bot for this repo.

Trusted users — org members and contributors with write access — can mention @kubestellar-hive in a comment to trigger repo automation.
On issues, that mention queues an automated fix attempt. On pull requests, it records extra context for existing automation.
This is not an interactive Q&A bot, so mentions should be treated as requests for automation rather than a conversation.

Automation may take a moment to start, and follow-up happens through workflow activity rather than chat replies.