Pin setup-node caching off in the dependency advisory watch

The scheduled watch reads each release line's lockfile in the default
branch's cache scope, so it deliberately writes no dependency cache.
It sets no cache input, but the pinned setup-node enables npm caching
on its own once package.json names npm as its packageManager. Nothing
declares that today; adding it later would silently reopen a
default-branch cache write here. Set package-manager-cache: false, as
five release workflows already do, assert it in the workflow test, and
say how the contract's no-dependency-cache promise is kept.

.github/workflows/dependency-advisory-watch.yml

@@ -89,6 +89,9 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
+          # setup-node enables npm caching by itself once package.json names
+          # npm as its packageManager; keep this scheduled job cache-free.
+          package-manager-cache: false
 
       - name: Audit complete frontend dependency graph
         id: audit

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -6269,7 +6269,9 @@ The second job is a fail-fast-free matrix over those branches. A scheduled job
 runs in the default branch's cache and token scope, so it never checks out,
 installs or runs another branch's code: each entry fetches the audited branch
 and reads only its `frontend-modern/package.json` and `package-lock.json` as
-data with `git show`, uses no dependency cache, and repeats the required
+data with `git show`, uses no dependency cache (its `actions/setup-node` step
+sets `package-manager-cache: false`, because that pin turns npm caching on by
+itself once `package.json` names npm as its `packageManager`), and repeats the required
 build-and-test audit against that lockfile with the same `actions/setup-node`
 pin and Node.js 24 and `scripts/npm-audit-retry.sh all` with
 `NPM_AUDIT_REQUIRE_RESULT=true`. `npm audit` answers from the lockfile, so the

scripts/tests/test_dependency_advisory_watch.py

@@ -180,6 +180,11 @@ class WorkflowContractTest(unittest.TestCase):
         self.assertNotIn("npm install", self.text)
         self.assertNotIn("actions/cache", self.text)
         self.assertNotRegex(self.text, r"(?m)^\s+cache(-dependency-path)?:")
+        # setup-node turns npm caching on automatically when package.json
+        # declares packageManager, so the absence of `cache:` is not enough.
+        setup_node = [step for step in audit if str(step.get("uses", "")).startswith("actions/setup-node@")]
+        self.assertEqual(1, len(setup_node))
+        self.assertIs(False, setup_node[0].get("with", {}).get("package-manager-cache"))
 
     def test_audit_matches_the_required_build_and_test_audit(self) -> None:
         build = yaml.safe_load(BUILD_AND_TEST.read_text(encoding="utf-8"))