Merge master and retain independent PR CI reliability fixes

.github/workflows/build-exe-for-python-sdk.yml

@@ -158,6 +158,8 @@ jobs:
         include: ${{ fromJSON(needs.plan.outputs.matrix) }}
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - uses: pnpm/action-setup@v4
         with:
@@ -194,7 +196,17 @@ jobs:
             pkg-fetch-${{ matrix.target }}-
 
       - name: Install (immutable)
-        run: pnpm install --frozen-lockfile
+        # node-gyp fetches Node headers from nodejs.org during install; that
+        # endpoint stalls intermittently (observed 10 s connect timeouts).
+        # Bounded retries mirror the wine lane's transfer policy without a
+        # mirror, since these installs also resolve native addons.
+        shell: bash
+        run: |
+          for attempt in 1 2 3; do
+            if pnpm install --frozen-lockfile; then exit 0; fi
+            [ "$attempt" -lt 3 ] && sleep 10
+          done
+          exit 1
 
       - name: Rebuild Linux node-pty against manylinux 2.28
         if: runner.os == 'Linux'