Merge remote-tracking branch 'origin/main' into agent/v5-nuget-mapping

# Conflicts:
#	crates/socket-patch-core/src/formats/nuget/mod.rs
#	crates/socket-patch-core/src/vendor/nuget_feed.rs

Author: mikolalysenko

.github/workflows/ci.yml

@@ -57,11 +57,12 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        # rustup is pre-installed on GitHub-hosted runners. `rustup show`
-        # reads rust-toolchain.toml in the repo root, then installs the
-        # pinned channel + listed components if missing. No third-party
+        # rustup is pre-installed on GitHub-hosted runners. `toolchain
+        # install` with no name reads rust-toolchain.toml in the repo root,
+        # then installs the pinned channel + listed components if missing
+        # (retried past download blips; see the script). No third-party
         # action dependency needed for toolchain setup.
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         # Swatinem/rust-cache instead of a raw actions/cache of the whole
@@ -100,7 +101,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
@@ -283,11 +284,13 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        # rustup is pre-installed on GitHub-hosted runners. `rustup show`
-        # reads rust-toolchain.toml in the repo root, then installs the
-        # pinned channel + listed components if missing. No third-party
+        # rustup is pre-installed on GitHub-hosted runners. `toolchain
+        # install` with no name reads rust-toolchain.toml in the repo root,
+        # then installs the pinned channel + listed components if missing
+        # (retried past download blips; see the script). No third-party
         # action dependency needed for toolchain setup.
-        run: rustup show
+        shell: bash
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         # Swatinem/rust-cache, main-only saves: see the first `Cache cargo`
@@ -449,11 +452,12 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        # rustup is pre-installed on GitHub-hosted runners. `rustup show`
-        # reads rust-toolchain.toml in the repo root, then installs the
-        # pinned channel + listed components if missing. No third-party
+        # rustup is pre-installed on GitHub-hosted runners. `toolchain
+        # install` with no name reads rust-toolchain.toml in the repo root,
+        # then installs the pinned channel + listed components if missing
+        # (retried past download blips; see the script). No third-party
         # action dependency needed for toolchain setup.
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         # Swatinem/rust-cache, main-only saves: see the first `Cache cargo`
@@ -493,12 +497,12 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        # `rustup show` installs the rust-toolchain.toml channel + listed
-        # components; `rustup component add` adds the llvm-tools-preview
+        # `toolchain install` installs the rust-toolchain.toml channel +
+        # listed components; `component add` adds the llvm-tools-preview
         # bits cargo-llvm-cov needs to merge .profraw files into lcov.
         run: |
-          rustup show
-          rustup component add llvm-tools-preview
+          scripts/rustup-retry.sh toolchain install
+          scripts/rustup-retry.sh component add llvm-tools-preview
 
       - name: Install cargo-llvm-cov
         # taiki-e/install-action ships precompiled binaries — much faster
@@ -676,11 +680,11 @@ jobs:
           driver: docker
 
       - name: Install Rust
-        # `rustup show` consumes rust-toolchain.toml; the explicit
+        # `toolchain install` consumes rust-toolchain.toml; the explicit
         # `component add` covers llvm-tools-preview for cargo-llvm-cov.
         run: |
-          rustup show
-          rustup component add llvm-tools-preview
+          scripts/rustup-retry.sh toolchain install
+          scripts/rustup-retry.sh component add llvm-tools-preview
 
       - name: Install cargo-llvm-cov
         uses: taiki-e/install-action@65851e10cd6c377f11a60e600abc07cb08643468 # v2.79.3
@@ -888,7 +892,8 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        run: rustup show
+        shell: bash
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
@@ -1104,11 +1109,13 @@ jobs:
           - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.1.45', test_filter: --include-ignored}
           # Bun >= 1.4 migrating a hosted workspace bun.lockb to bun.lock
           # (#803; its reader must be 1.4+) and a vendored one, then
-          # reverting it (#784; skipped by the < 1.2 readers above). Both
+          # reverting it (#784; skipped by the < 1.2 readers above), and a
+          # hosted pin on a record Bun 1.2+ shares between a regular and a
+          # bundled install (#1243; also skipped below 1.2). Both
           # 1.4.2 and 1.3.14 also run the isolated-linker vendored re-run
           # after a late dependent (#861); 1.3 re-hoists a frozen binary lock
           # and refuses one whose trees changed.
-          - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.4.2', test_filter: --include-ignored text_migration workspace_late_dependent}
+          - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.4.2', test_filter: --include-ignored text_migration workspace_late_dependent binary_shared_bundled_record_hosted_pin_is_managed}
           - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.3.14', test_filter: --include-ignored workspace_late_dependent}
           # Real-vlt capstones (DESIGN §8.4): wiremock patch service and a local
           # npm registry fed from npmjs, driven by the pinned vlt release
@@ -1933,7 +1940,7 @@ jobs:
           driver: docker
 
       - name: Install Rust
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
 
       # No `actions/cache` here intentionally. This job builds Docker
       # images and would be flagged by zizmor's cache-poisoning audit.
@@ -2010,7 +2017,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
@@ -2057,7 +2064,8 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        run: rustup show
+        shell: bash
+        run: scripts/rustup-retry.sh toolchain install
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
@@ -2163,15 +2171,16 @@ jobs:
           tar -xf target/e2e-bin.tar -C target/e2e-bin
           rm target/e2e-bin.tar
       - name: Install Rust
-        run: rustup show
+        shell: bash
+        run: scripts/rustup-retry.sh toolchain install
       - name: Install the cargo under test
         # bash, not the Windows default pwsh: in PowerShell
         # "$CARGO_TEST_TOOLCHAIN" is an (unset) PowerShell variable, so the
         # windows-latest leg ran `rustup toolchain install ""`.
         shell: bash
         env:
           CARGO_TEST_TOOLCHAIN: ${{ matrix.toolchain }}
-        run: rustup toolchain install "$CARGO_TEST_TOOLCHAIN" --profile minimal
+        run: scripts/rustup-retry.sh toolchain install "$CARGO_TEST_TOOLCHAIN" --profile minimal
       - name: Real-cargo hosted/vendored + manifest-less VEX
         # The e2e-build binaries, run from the package root as `cargo test`
         # would (see the e2e job's staging step).
@@ -2286,7 +2295,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
       - name: Pull the old cargos under test
         run: |
           docker pull rust:1.41-slim
@@ -2392,7 +2401,7 @@ jobs:
 
       - name: Install Rust
         if: steps.gate.outputs.run == 'true'
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         if: steps.gate.outputs.run == 'true'

.github/workflows/vlt-compatibility.yml

@@ -43,6 +43,8 @@ on:
       - 'scripts/vlt-historical-integrity.json'
       - 'scripts/gen-vlt-collation-golden.mjs'
       - 'scripts/ci-vlt-proof-suites.py'
+      - 'scripts/vlt-compat-gate.py'
+      - 'scripts/tests/test_vlt_compat_gate.py'
       - '.github/workflows/ci.yml'
       - 'scripts/tests/test_ci_vlt_rows.py'
   push:
@@ -84,6 +86,8 @@ on:
       - 'scripts/vlt-historical-integrity.json'
       - 'scripts/gen-vlt-collation-golden.mjs'
       - 'scripts/ci-vlt-proof-suites.py'
+      - 'scripts/vlt-compat-gate.py'
+      - 'scripts/tests/test_vlt_compat_gate.py'
       - '.github/workflows/ci.yml'
       - 'scripts/tests/test_ci_vlt_rows.py'
   schedule:
@@ -136,8 +140,41 @@ jobs:
       - name: Every era, suite and OS is covered
         run: python3 -B -m unittest scripts/tests/test_ci_vlt_rows.py -v
 
-  build:
+  # Both filters list ci.yml for its vlt `e2e` rows, which install-proof
+  # leaves out. A PR or push whose only matching change is ci.yml, with
+  # those rows untouched, would rerun the matrix exactly as on the base:
+  # matrix-coverage above still checks it, the rest is skipped.
+  changes:
     if: github.event.pull_request.draft != true
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.gate.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          # A PR's merge commit has the base it was merged onto as parent 1.
+          fetch-depth: 2
+      - id: gate
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PUSH_BEFORE: ${{ github.event.before }}
+        run: |
+          set -euo pipefail
+          case "$EVENT_NAME" in
+            pull_request) base=HEAD^1 ;;
+            push) base="$PUSH_BEFORE" ;;
+            *) base='' ;;
+          esac
+          if [ -n "$base" ] && ! git rev-parse --verify --quiet "$base^{commit}" >/dev/null; then
+            git fetch --quiet --depth 1 origin "$base" || true
+          fi
+          python3 -B scripts/vlt-compat-gate.py --event "$EVENT_NAME" --base "$base" >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: changes
+    if: needs.changes.outputs.matrix == 'true'
     strategy:
       fail-fast: false
       matrix:
@@ -373,7 +410,8 @@ jobs:
     steps: *install-proof-steps
 
   plan:
-    if: github.event.pull_request.draft != true
+    needs: changes
+    if: needs.changes.outputs.matrix == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     outputs:
@@ -468,8 +506,8 @@ jobs:
           retention-days: 14
 
   lock-diff:
-    needs: native
-    if: ${{ !cancelled() }}
+    needs: [changes, native]
+    if: ${{ !cancelled() && needs.changes.outputs.matrix == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps: