research: non-destructive security PoC (FINDING-GH-011; do NOT merge)

[orihamama]

Security research probe — non-destructive

This PR exists ONLY to verify the workflow primitive identified in our
security finding for js-linter.yml (and siblings). It will be closed
without merge as soon as the workflow run log is captured.

What the PoC does

Adds frontend/.poc-postinstall.js (called via npm install's
postinstall lifecycle hook). The script logs:

• whoami, hostname, cwd, runner OS/arch
• KEY NAMES of env vars in GITHUB_*, ACTIONS_*, RUNNER_*, NPM_*,
  NODE_*, GH_* — values fully redacted (length only)
• BOOLEAN presence of GITHUB_TOKEN, NODE_AUTH_TOKEN, NPM_TOKEN,
  OIDC tokens
• A marker file in node_modules/.cache/_poc/ to demonstrate cache-write
  reachability (V6 primitive)

What it does NOT do

• No network egress beyond standard CI traffic
• No secret value printing
• Marker file content contains no secrets
• No persistence outside this run

Why we are filing this

We are coordinating a security disclosure with RoboSats maintainers.
This PR establishes runtime evidence of the V1B+V6 primitive for our
report. Methodology mirrors the published apache/doris FINDING-GH-7
disclosure (PR #62904 patched 2026-04-28).

We will close this PR within 1 hour of the workflow run completing.