chore: add local validation script, minimal compose, and npm 403 troubleshooting

[felipeofdev-ai]

Motivation

• Unblock confidence in runtime behavior by providing a deterministic local validation flow to detect the current blocker (npm registry 403) and prove core services actually run.
• Provide a minimal, fast proof-of-life stack (Postgres + Collector) so teams can validate ingress → persistence → export without standing up the full platform.
• Reduce accidental registry/proxy misconfiguration by pinning a sane default registry and documenting triage steps for npm 403 failures.

Description

• Added a root .npmrc that points to the public npm registry and disables optional prompts (registry=https://registry.npmjs.org/, fund=false, audit=false).
• Added an end-to-end local validation script scripts/validate-local.sh that runs npm install, boots a minimal stack, exercises GET /metrics, posts a webhook to /webhooks/gitlab, checks /audit/integrity, fetches /audit/export, and runs the CLI verifier; it writes reports/local-validation-report.md.
• Added docker-compose.minimal.yml (Postgres + Collector) and Makefile targets up-minimal and validate-local to simplify the 30-minute local validation path.
• Added docs/engineering/npm-registry-troubleshooting.md with a practical checklist to triage npm install 403 issues and recommended lockfile strategy (npm install locally + commit package-lock.json then use npm ci in CI).
• Updated README.md to surface the new quickstart targets (make up-minimal, make validate-local) and the validation artifacts.

Testing

• Verified shell script syntax with bash -n scripts/validate-local.sh (passed).
• Ran git diff --check to validate whitespace/diff issues (passed).
• Executed a Python sanity check that asserts presence of the key artifacts (.npmrc, scripts/validate-local.sh, docker-compose.minimal.yml, docs/engineering/npm-registry-troubleshooting.md) (passed).

---

Codex Task