security: harden tanstack client security

[jorgenosberg]

Switch to pnpm instead of npm with additional steps for security hardening.

This is particularly important in these days since we're seeing repeated wide-reaching supply-chain attacks in the node+npm ecosystem, e.g. the latest:
https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/

[Copilot]

Pull request overview

This PR hardens the TanStack Start example client’s Node dependency posture by standardizing on pnpm, pinning dependency versions, and adding CI enforcement plus documentation for a repository-wide Node dependency security baseline.

Changes:

• Switch TanStack Start client to pnpm with exact (fully pinned) dependency versions, committed pnpm-lock.yaml, and restricted dependency build scripts.
• Add a dedicated security workflow that runs install/typecheck/lint/test/build and a high/critical pnpm audit.
• Minor client code safety improvements (remove non-null assertions; stabilize traveler row keys via generated IDs) and documentation updates.

Reviewed changes

Copilot reviewed 13 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Links to the new Node dependency security baseline doc.
docs/node-dependency-security.md	Adds baseline guidance for pnpm + pinning + CI security checks.
clients/tanstack-start/src/routes/offers.tsx	Avoids non-null assertions when collecting offer IDs.
clients/tanstack-start/src/context/search-form.tsx	Extends TravelerIndividual with optional id for stable identity.
clients/tanstack-start/src/components/search/TravelerPicker.tsx	Generates stable traveler IDs and avoids unsafe non-null assertion when reading group metadata.
clients/tanstack-start/src/components/checkout/BundleCard.tsx	Removes non-null assertion when pushing into grouped offers.
clients/tanstack-start/README.md	Updates local commands to pnpm and documents pinned-version update workflow.
clients/tanstack-start/pnpm-workspace.yaml	Adds pnpm workspace/security-related settings.
clients/tanstack-start/pnpm-lock.yaml	Introduces pnpm lockfile for reproducible installs.
clients/tanstack-start/package.json	Pins all direct deps, adds pnpm build-script allowlist, and pins toolchain via packageManager/engines.
clients/tanstack-start/.node-version	Pins Node version for the TanStack Start client.
clients/tanstack-start/.env.example	Updates comments to reflect pnpm dev and clarifies defaults.
.github/workflows/tanstack-start-security.yml	Adds CI workflow enforcing frozen lockfile + quality gates + audit.
.github/dependabot.yml	Adds Dependabot configuration for actions, Node deps, and Python/uv.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.