Add pre-install npm dependency guard

action.yml

@@ -0,0 +1,37 @@
+name: Dependency Guard
+description: Verify npm dependencies before allowing lifecycle scripts
+inputs:
+  path:
+    description: Path to the npm project
+    required: false
+    default: .
+  policy:
+    description: Path to the dependency-guard policy JSON
+    required: false
+    default: ""
+  report:
+    description: Path for the JSON evidence report
+    required: false
+    default: dependency-guard-report.json
+  skip-install:
+    description: Skip npm ci and npm audit commands
+    required: false
+    default: "false"
+runs:
+  using: composite
+  steps:
+    - name: Check Node.js version
+      shell: bash
+      run: node -e 'const major=Number(process.versions.node.split(".")[0]); if(major<20) throw new Error("dependency-guard requires Node.js 20 or newer")'
+    - name: Verify dependencies
+      shell: bash
+      env:
+        INPUT_PATH: ${{ inputs.path }}
+        INPUT_POLICY: ${{ inputs.policy }}
+        INPUT_REPORT: ${{ inputs.report }}
+        INPUT_SKIP_INSTALL: ${{ inputs.skip-install }}
+      run: |
+        args=(check --path "$INPUT_PATH" --report "$INPUT_REPORT")
+        if [[ -n "$INPUT_POLICY" ]]; then args+=(--policy "$INPUT_POLICY"); fi
+        if [[ "$INPUT_SKIP_INSTALL" == "true" ]]; then args+=(--skip-install); fi
+        node "$GITHUB_ACTION_PATH/bin/dependency-guard.js" "${args[@]}"