fix(policy): intersect the inventory with the scaffold lockfile — only used first-party names are exempted

[pyramation]

Summary

Follow-up to #57. Both workspace templates (pgpm/, pnpm/) had intersect: false, so the committed pnpm-workspace.yaml a new user gets from pgpm init workspace exempted every one of the ~890 inventory names (@cosmos-kit/*, create-akash-app, …) from minimumReleaseAge — packages no scaffold uses. That's misleading, and not how pnpm-policy is meant to be used.

• pnpm-policy.yaml (both templates): intersect: false → intersect: true (the pnpm-policy default). Scope globs are never intersected, and the explicit packages: claims from fix(policy): fresh pgpm init workspace must install our own packages on release day; CI now proves it #57 survive intersection, so release-day installs still work.
• pnpm-workspace.yaml regenerated by pnpm run policy inside a real scaffold (pgpm init workspace + pgpm init + pnpm install against the registry), then copied back — the generator needs a lockfile to intersect against, and the template dir itself has none. Result: 6 scope globs + 75 (pgpm) / 8 (pnpm) first-party names, down from ~890.

Verified by re-scaffolding from the regenerated templates: pnpm install (no release-age override), pnpm run policy:check, pnpm build, pnpm test all pass. The scaffold.yml workflow from #57 runs the same flow in CI.

Same fix in pglite-boilerplates #8, dashboard #271, brand-kit #4, agents-demo-testing #2.

Link to Devin session: https://app.devin.ai/sessions/d34558e831ad4bbf986f64cc4bd509bd
Open in Devin Desktop: https://app.devin.ai/desktop/session/d34558e831ad4bbf986f64cc4bd509bd?variant=devin
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. No issues found — approved ✅.

---

This change introduces generated pnpm configuration YAML files (pnpm-policy.yaml and pnpm-workspace.yaml) into the pgpm and pnpm workspace boilerplate templates. All four files are declarative key-value configuration with no executable logic; the triage classified all files as skips and no specialist lenses or domain clusters apply. Because no changed file contains procedural code, no findings were produced.

_{Reviewed commit: 02eb935}