Merge remote-tracking branch 'origin/master' into fix/runner-paid-matrix-integrity

* origin/master:
  ci(runner): build paid artifacts once per campaign (#12777)
  chore(deps): bump lucide-react from 1.32.0 to 1.38.0 (#12313)

# Conflicts:
#	.github/workflows/runner-full-stack-e2e.yml
#	tests/runner-e2e/README.md
#	tests/runner-e2e/SECURITY.md
#	tests/runner-e2e/history.test.ts
#	tests/runner-e2e/workflow-security.test.ts

.github/workflows/runner-full-stack-e2e.yml

@@ -495,7 +495,7 @@ jobs:
           node-version: 24
           cache: pnpm
 
-      - run: pnpm install --frozen-lockfile
+      - run: pnpm install --frozen-lockfile --ignore-scripts
 
       # build:typescript also builds the eval-kernel dependency, so the two
       # TypeScript trees are compiled at most once in this campaign.
@@ -617,7 +617,7 @@ jobs:
           cache: pnpm
 
       - if: needs.catalog.outputs.needs_remote_provider_pack == 'true'
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
 
       - name: Download immutable shared campaign outputs
         if: needs.catalog.outputs.needs_remote_provider_pack == 'true'