chore(ci): enforce minimum release age via Yarn's native gate + freeze qa install

Supply-chain hardening (Asana 1216667157595351):
- .yarnrc.yml: npmMinimalAgeGate 4320 (3 days) + npmPreapprovedPackages
  @convertcom/* — Yarn refuses to install a dependency version younger than
  3 days (the smash-and-grab filter), exempting our internal scope.
- qa.yml: freeze the dependency install (yarn -> yarn install --immutable) so
  CI installs strictly from the committed lockfile.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Ahmed Abbas

.github/workflows/qa.yml

@@ -35,7 +35,7 @@ jobs:
           corepack prepare yarn@stable --activate
 
       - name: Install dependencies
-        run: yarn
+        run: yarn install --immutable
 
       - name: Install Playwright browsers
         run: |

.yarnrc.yml

@@ -1 +1,9 @@
 nodeLinker: node-modules
+
+# Supply-chain minimum release age: refuse to install any dependency version
+# published less than 3 days ago (smash-and-grab malware is usually yanked
+# within hours). Internal @convertcom/* packages are exempt so our own release
+# chain never stalls on a freshly-published package.
+npmMinimalAgeGate: 4320
+npmPreapprovedPackages:
+  - "@convertcom/*"