fix(registry): preserve release-age policy in smoke consumers

[yyyyaaa]

Summary

• read the repository's active minimumReleaseAge value in the registry smoke harness
• give each throwaway smoke consumer that same threshold plus the narrow @constructive-io/* exemption needed for the local tarballs under test

Why

PR #16 enables pnpm's two-day release-age quarantine. Its delivery job fails because the clean sheets consumer applies the threshold to the freshly packed local @constructive-io/data artifact, even though that first-party scope is exempt in the repository policy.

This keeps the delivery gate and the two-day third-party quarantine intact. It only carries the existing first-party exemption across the temporary-workspace boundary, so PR #16 can be rebased after this merges.

Verification

• pnpm lint:scripts
• pnpm --filter @constructive-io/registry test
• cherry-picked this reduced commit onto PR chore: adopt the pnpm supply-chain policy #16 head d3ffd65, then passed a clean package-backed sheets install with minimumReleaseAge: 2880 still active