build: pin the @sorb scope to rohana instead of relying on the lockfile

Nothing in this repo said where @sorb/threadnet-call-embedded comes from. It
worked only because pnpm-lock.yaml carries the full tarball URL and CI installs
with --frozen-lockfile; the first version bump drops that cover. Today that ends
in a 404 because the name is still free on npmjs - which makes our only
protection the fact that nobody has claimed @sorb there. Claim it and the same
command resolves silently against a stranger's package, in the exact moment a
fresh download looks normal.

The checked-in .npmrc closes the wrong path instead of documenting it. It holds a
URL and no secret: read access to the registry is anonymous.

Upstream's .gitignore ignores /.npmrc - reasonable where the file holds tokens,
and it would have swallowed this fix without a word. The negation is explicit and
carries the reason, so the next merge does not quietly restore the hole.

Verified in an isolated tree, not assumed: without the file pnpm resolves to
npmjs and fails; with it the scope resolves to rohana at the same integrity hash
the repo lockfile already carries; with rohana unreachable the install fails
outright rather than falling back to npmjs. pnpm install --frozen-lockfile still
passes and leaves the lockfile untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -5,6 +5,11 @@
 /lib
 node_modules
 /.npmrc
+# ThreadNet-Fork: unsere .npmrc IST versioniert. Sie bindet nur den Scope @sorb an
+# die Registry auf rohana und enthaelt kein Geheimnis (Lesezugriff ist anonym).
+# Ohne diese Ausnahme bliebe die Datei lokal, und CI wie frischer Klon loesten
+# @sorb weiter gegen npmjs auf - siehe management#0055.
+!/.npmrc
 /*.log
 package-lock.json
 .DS_Store