Merge frozen Pulse upstream for coordination batch

# Conflicts:
#	.github/workflows/build-and-test.yml
#	scripts/installtests/build_release_assets_test.go
#	scripts/npm-audit-retry.sh

Change-source: pulse-maintainer

.github/workflows/README.md

@@ -105,12 +105,15 @@ failed release-trust check still permits activation-marker inspection when the
 tag, numeric release ID, and exact source SHA are structurally valid. This
 exposes independent marker damage in the same evidence packet; it never admits
 the release or enables later delivery checks unless both trust checks pass.
-Scheduled and push-time npm audits use one-minute registry attempts and retry
-only explicit network or audit-endpoint failures. Advisory findings still fail
-without retry, and three unavailable registry responses remain a failed check.
-Audit steps defer their aggregate verdict so an unavailable advisory endpoint
-cannot suppress independent frontend checks or the production bundle build;
-the preceding clean install disables npm's duplicate best-effort audit request.
+Scheduled and push-time npm audits classify JSON results, use one-minute
+registry attempts, and retry an unavailable audit endpoint. Advisory findings
+still fail immediately, even if the same response contains a transport error. The
+scheduled security scan and dependency-changing builds fail if three attempts
+produce no result; a build with an unchanged dependency graph warns and uses
+the base commit's passing answer. Audit steps defer their aggregate verdict so
+an unavailable endpoint cannot suppress independent frontend checks or the
+production bundle build; the preceding clean install disables npm's duplicate
+best-effort audit request.
 Activation inspection also requires exactly one uploaded marker and compares
 the downloaded byte count and SHA-256 value with GitHub's release-asset
 metadata, so a valid-looking JSON response cannot silently replace or truncate

.github/workflows/build-and-test.yml

@@ -71,6 +71,7 @@ jobs:
     timeout-minutes: 5
     outputs:
       code: ${{ steps.filter.outputs.code }}
+      frontend_deps: ${{ steps.filter.outputs.frontend_deps }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -88,8 +89,9 @@ jobs:
             base="${{ github.event.before }}"
           fi
           if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ] || ! git cat-file -e "$base" 2>/dev/null; then
-            echo "Base commit unavailable; assuming code changed."
+            echo "Base commit unavailable; assuming code and dependencies changed."
             echo "code=true" >> "$GITHUB_OUTPUT"
+            echo "frontend_deps=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
           changed=$(git diff --name-only "$base" "${{ github.sha }}")
@@ -102,6 +104,17 @@ jobs:
             code=false
           fi
           echo "code=$code" >> "$GITHUB_OUTPUT"
+          # Whether this change moves the frontend dependency graph. It decides
+          # what an unreachable npm advisory endpoint means: unknown answer
+          # (must block) versus the base commit's already-passing answer. A
+          # change to the audit runner itself also demands a real result, so it
+          # can never be relaxed under cover of its own tolerant mode.
+          if printf '%s\n' "$changed" | grep -qE '^frontend-modern/package(-lock)?\.json$|^scripts/npm-audit-retry\.sh$'; then
+            frontend_deps=true
+          else
+            frontend_deps=false
+          fi
+          echo "frontend_deps=$frontend_deps" >> "$GITHUB_OUTPUT"
 
   frontend:
     name: Frontend
@@ -131,17 +144,24 @@ jobs:
         # npm ci's duplicate best-effort audit POST and its five-minute timeout.
         run: npm ci --no-audit
 
+      # npm audit exits 1 both for a real advisory and for an unreachable
+      # advisory endpoint. The runner keeps the advisory verdict exactly as
+      # strict and only retries the endpoint being down; see the script header.
       - name: Audit complete frontend dependency graph
         id: audit-complete
         continue-on-error: true
         working-directory: frontend-modern
-        run: '"${GITHUB_WORKSPACE}/scripts/npm-audit-retry.sh"'
+        env:
+          NPM_AUDIT_REQUIRE_RESULT: ${{ needs.changes.outputs.frontend_deps }}
+        run: bash "$GITHUB_WORKSPACE/scripts/npm-audit-retry.sh" all
 
       - name: Audit production frontend dependencies
         id: audit-production
         continue-on-error: true
         working-directory: frontend-modern
-        run: '"${GITHUB_WORKSPACE}/scripts/npm-audit-retry.sh" --omit=dev'
+        env:
+          NPM_AUDIT_REQUIRE_RESULT: ${{ needs.changes.outputs.frontend_deps }}
+        run: bash "$GITHUB_WORKSPACE/scripts/npm-audit-retry.sh" production
 
       # Whole-tree, not staged-only: the pre-commit formatter only ever sees
       # staged files, so drift in untouched files is invisible to it. This is

.github/workflows/security-scan.yml

@@ -386,13 +386,13 @@ jobs:
         id: audit-complete
         continue-on-error: true
         working-directory: ${{ matrix.directory }}
-        run: '"${GITHUB_WORKSPACE}/scripts/npm-audit-retry.sh" --package-lock-only'
+        run: bash "$GITHUB_WORKSPACE/scripts/npm-audit-retry.sh" all --package-lock-only
 
       - name: Audit production dependencies
         id: audit-production
         continue-on-error: true
         working-directory: ${{ matrix.directory }}
-        run: '"${GITHUB_WORKSPACE}/scripts/npm-audit-retry.sh" --package-lock-only --omit=dev'
+        run: bash "$GITHUB_WORKSPACE/scripts/npm-audit-retry.sh" production --package-lock-only
 
       - name: Require dependency audits
         if: ${{ !cancelled() }}