The type-check E2E fixture installs vitest@^4.1.0 in a fresh tmpdir,
which resolves to vitest 4.1.7 and pulls tinyexec@1.2.2. Since
2026-05-23, tinyexec 1.2.x is published via npm's staged-publishes
flow (tinylibs/tinyexec#129 #130), which drops the trusted-publisher
metadata that 1.1.2 had. pnpm's trustPolicy: no-downgrade gate
therefore rejects the install with ERR_PNPM_TRUST_DOWNGRADE on
every PR.

Audit findings (same maintainer 43081j across all versions, PRs
visible and merged in tinylibs/tinyexec, code diff 1.1.2..1.2.2 is
benign refactor + tests + nodePath feature): the metadata change is
a benign maintainer-driven hardening (manual approval gate added
via GitHub environment + npm stage publish), not a takeover.

pnpm upstream explicitly recommends trustPolicyExclude for audited
false positives (pnpm/pnpm#10622). Pass
--config.trust-policy-exclude=tinyexec@* on the fixture install
rather than the broader --config.trust-policy=no-check, so any
other supply-chain regression still trips no-downgrade. The
workspace-level trustPolicy: no-downgrade defense is unchanged.

Remove once upstream restores trusted-publisher attestation, or
once trustPolicyIgnoreAfter self-heals it (around 2026-06-22).