Apply the ratified dependency policy.

[martnpaneq]

🚀 Summary

Applies the ratified dependency policy in this repository:

• pnpm is pinned to 11.14.0 everywhere it is installed. It was a floating range before, which left the tool that enforces the cooldown and the build allowlist as the least pinned thing we have.
• Every automated install now says --frozen-lockfile, instead of relying on pnpm switching it on by itself once it notices CI.
• The *ckeditor5* cooldown exclusion is replaced by the four unscoped names we own. The glob matched any package with ckeditor5 in the name, including someone else's, and an excluded name skips the cooldown completely.
• The remaining global installs name exact versions.
• A CODEOWNERS file is added - this repository had none, so nothing required a platform-team review of its lockfile or CI. It covers the dependency and CI paths the policy names, not the source directories.
• blockExoticSubdeps: true is added, so only registry tarballs can enter the tree as subdependencies.

---

📌 Related issues

• See https://github.com/ckeditor/ckeditor5-internal/issues/4697.
• Policy and per-repository findings: https://github.com/ckeditor/ckeditor5-internal/issues/4665.
• blockExoticSubdeps: harden: missing or incorrect trustpolicy in pnpm-workspace.yaml... ckeditor5#20216.

---

💡 Additional information

Checked with pnpm install --frozen-lockfile --lockfile-only on pnpm 11.14.0: the lockfile passes (1683 entries), so blockExoticSubdeps does not reject anything in the tree today. The CircleCI jobs themselves were not run, so CI here is the real check.

Internal only (CI and dependency settings), so no changelog entry.