Include yarn.lock / pnpm.lock in Harper releases for non-npm installs

Harper ships `npm-shrinkwrap.json` to lock transitive dependencies for npm installs. Operators who install with Yarn or pnpm don't benefit from this lock. Publishing `yarn.lock` and `pnpm.lock` would extend supply-chain protection to those package managers.

## Ask

- Generate and commit `yarn.lock` and `pnpm.lock` (or produce them as release artifacts).
- Verify they are picked up by Yarn / pnpm installs.
- Wire into Renovate / lockfile-maintenance so they stay current.

---

Jira fields: **Feature Type:** Security · **Business Impact:** Operational efficiency

🤖 Filed by Claude on behalf of Kris.

Start by checking how npm-shrinkwrap.json is generated and included in releases, then inspect the existing Renovate or lockfile-maintenance configuration. Verify that yarn.lock and pnpm.lock are consumed by Yarn and pnpm installs; done means both are published or generated as release artifacts and kept current automatically.

Written by the indexing model from the issue text.