Pin setup-node caching off in the dependency advisory watch (#2383)

The scheduled dependency advisory watch reads each release line's
lockfile in the default branch's cache scope, so it deliberately writes
no dependency cache. It sets no `cache` input, but the pinned
`actions/setup-node` enables npm caching on its own once `package.json`
names npm as its `packageManager`. Nothing declares that today; adding
it later would silently reopen a default-branch cache write here.

- Set `package-manager-cache: false` on the watch's setup-node step, as
five release workflows already do.
- Assert it in `scripts/tests/test_dependency_advisory_watch.py`;
removing the line fails exactly that test.
- Note in the deployment-installability contract how the
no-dependency-cache promise is kept.

.github/workflows/dependency-advisory-watch.yml

@@ -89,6 +89,9 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
+          # setup-node enables npm caching by itself once package.json names
+          # npm as its packageManager; keep this scheduled job cache-free.
+          package-manager-cache: false
 
       - name: Audit complete frontend dependency graph
         id: audit

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -6269,7 +6269,9 @@ The second job is a fail-fast-free matrix over those branches. A scheduled job
 runs in the default branch's cache and token scope, so it never checks out,
 installs or runs another branch's code: each entry fetches the audited branch
 and reads only its `frontend-modern/package.json` and `package-lock.json` as
-data with `git show`, uses no dependency cache, and repeats the required
+data with `git show`, uses no dependency cache (its `actions/setup-node` step
+sets `package-manager-cache: false`, because that pin turns npm caching on by
+itself once `package.json` names npm as its `packageManager`), and repeats the required
 build-and-test audit against that lockfile with the same `actions/setup-node`
 pin and Node.js 24 and `scripts/npm-audit-retry.sh all` with
 `NPM_AUDIT_REQUIRE_RESULT=true`. `npm audit` answers from the lockfile, so the

scripts/tests/test_dependency_advisory_watch.py

@@ -180,6 +180,11 @@ class WorkflowContractTest(unittest.TestCase):
         self.assertNotIn("npm install", self.text)
         self.assertNotIn("actions/cache", self.text)
         self.assertNotRegex(self.text, r"(?m)^\s+cache(-dependency-path)?:")
+        # setup-node turns npm caching on automatically when package.json
+        # declares packageManager, so the absence of `cache:` is not enough.
+        setup_node = [step for step in audit if str(step.get("uses", "")).startswith("actions/setup-node@")]
+        self.assertEqual(1, len(setup_node))
+        self.assertIs(False, setup_node[0].get("with", {}).get("package-manager-cache"))
 
     def test_audit_matches_the_required_build_and_test_audit(self) -> None:
         build = yaml.safe_load(BUILD_AND_TEST.read_text(encoding="utf-8"))