Merged supply-chain hardening PR after checks passed/neutral and unrelated workflow-triggered validator drift was removed from the diff.