Merge origin/main into fix/user-patched-deps-pnpm-yarn-vlt

The old base fix/npm-discovery-false-attestation landed on main as the
squash 32e1630 (#2010), whose tree is identical to that branch's tip
f665796, which this branch already contains. Keeping this branch's tree
therefore applies exactly the PR's own changes on top of main.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude