Respect package managers' native minimum release age

[bircni]

Summary

The npm ecosystem now ships built-in supply-chain "cooldown" settings — a minimum age a published version must reach before a package manager will install it. updates already has its own cooldown option, but ignored these native settings. This PR makes the npm mode automatically honor them, so updates never proposes a version the package manager itself would refuse to install.

The nearest config file above each manifest is read and normalized to days:

Package manager	File	Setting (unit)	Exclude list
npm	.npmrc	min-release-age (days)	min-release-age-exclude
pnpm	pnpm-workspace.yaml or .npmrc	minimumReleaseAge / minimum-release-age (minutes)	minimumReleaseAgeExclude / minimum-release-age-exclude
bun	bunfig.toml [install]	minimumReleaseAge (seconds)	minimumReleaseAgeExcludes

When several are present, the most conservative age and the union of exclude lists apply.

Precedence

An explicit updates cooldown always wins; the native value is only a fallback when updates has none:

1. Per-package overrides cooldown
2. Global/per-dir cooldown (incl. --cooldown) — an explicit 0 disables the native fallback
3. Native package-manager setting (with its exclude list, which supports globs like @myorg/*)

This is on by default for the npm mode. Other modes (pypi, go, cargo, docker, make, actions) are unaffected. uv/pypi is intentionally left out for now — its pyproject.toml exclude-newer is an absolute timestamp rather than a relative age and needs a separate mechanism.

[bircni]

adding yarn support, too

[silverwind]

I already added a parser for renovate's setting but it's not enabled by default specifically because I want -C or updates.config.ts to be the only source of that option.

Building a complex config inheritance system from dozens of other tools is not what I want to maintain and it would be too confusing to users.

So for this reason I think I will reject and probably also drop the renovate inheritance.

Users should configure this tool via -C or updates.config.ts only and personally I prefer to keep the default cooldown of 0 (I need this specifically to quickly cascade updates in libraries etc).