ci: add shared lockfile release-age guard

[TheRealBecks]

Summary

• add a fail-closed 72-hour release-age guard for introduced Cargo and npm lockfile entries
• bound public-registry lookups with isolated workers, deadlines, retries, and size limits
• add deterministic security, malformed-input, timeout, and Git integration tests
• document immutable consumer pinning and add repository CI/Renovate policy

Verification

• python3 -m unittest discover --start-directory tests --verbose
• python3 -m py_compile scripts/lockfile_release_age.py
• parsed the current Cargo.lock and package-lock.json files from all four consumers

Closes #2