fix(release): disable preflight package cache

.github/workflows/release-stable.yml

@@ -334,6 +334,7 @@ jobs:
         uses: actions/setup-node@v5
         with:
           node-version: "24.19.0"
+          package-manager-cache: false
 
       - name: 🔎 PREFLIGHT exact stable artifacts
         env:

scripts/release-policy-contract.test.mjs

@@ -341,6 +341,10 @@ const stableCapabilityViolations = (source) => {
   ) {
     violations.push("stable PREFLIGHT read-only credentials")
   }
+  const preflightSetupNode = extractSteps(jobs.preflight).find((step) => step.uses.startsWith("actions/setup-node@"))
+  if (preflightSetupNode?.packageManagerCache !== "false") {
+    violations.push("stable PREFLIGHT setup-node package-manager cache")
+  }
 
   const finalizeSteps = extractSteps(jobs.finalize)
   const finalizeCredentialSteps = finalizeSteps.filter((step) =>
@@ -1810,6 +1814,15 @@ test("the Node-only release policy job can bootstrap setup-node without pnpm", (
   assert.deepEqual(releasePolicyBootstrapViolations(pnpmFirst), [])
 })
 
+test("stable PREFLIGHT can bootstrap setup-node without pnpm", () => {
+  assert.deepEqual(stableCapabilityViolations(workflows.stable), [])
+
+  const cacheEnabled = mutate(workflows.stable, "package-manager-cache: false", "package-manager-cache: true")
+  assert.ok(
+    stableCapabilityViolations(cacheEnabled).includes("stable PREFLIGHT setup-node package-manager cache"),
+  )
+})
+
 test("release documentation leads with the three-channel mapping", () => {
   for (const document of [readme, setup]) {
     const active = withoutComments(document)