fix: use pnpm pack instead of tar for RL scanner artifact

[Copilot]

The RL scanner job was failing because the artifact being scanned was ~186 MB — the entire workspace including node_modules, src/, and test files — exceeding the scanner's monthly analysis limit.

Changes

• .github/workflows/rl-secure.yml: Replace tar -czvf "$ARTIFACT_NAME" * with pnpm pack, which respects the "files": ["dist"] declaration in package.json and produces only the compiled output

# Before — entire workspace (~186 MB)
tar -czvf "$ARTIFACT_NAME" *

# After — dist/ only, matching what gets published to npm
pnpm pack --pack-destination .
mv *.tgz "$ARTIFACT_NAME"

This also aligns the scanned artifact with what actually ships to consumers.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.06%. Comparing base (42a81f4) to head (039cdf2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2826   +/-   ##
=======================================
  Coverage   89.06%   89.06%           
=======================================
  Files          80       80           
  Lines       11978    11978           
  Branches     2501     2501           
=======================================
  Hits        10668    10668           
  Misses       1265     1265           
  Partials       45       45           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.