Merge remote-tracking branch 'origin/master' into worktree/docs-website

# Conflicts:
#	docs/rfc/INDEX.md
#	package.json
#	pnpm-lock.yaml

pnpm-workspace.yaml

@@ -23,6 +23,7 @@ allowBuilds:
   # need, so we deny them — install still succeeds.
   '@google/genai': false
   protobufjs: false
+  node-addon-require-builtin: false
 
 # The Landlock launcher family is our own sibling-repo release, consumed
 # fresh (hours old at each coordinated bump) — the release-age quarantine
@@ -32,3 +33,7 @@ minimumReleaseAgeExclude:
   - node-addon-landlock-run
   - node-addon-landlock-run-linux-arm64
   - node-addon-landlock-run-linux-x64
+  # Cordis release candidates are source-vendored and pinned in vendor/README.md
+  # during the same-day sync that updates package manifests and the lockfile.
+  - '@cordisjs/plugin-loader@1.0.0-rc.5'
+  - cordis@4.0.0-rc.7