Merge main into releases/v4

[github-actions]

Merging 7dd76e6 into releases/v4.

Conductor for this PR is @mbg.

Contains the following pull requests:

• Upload failed SARIF for risk assessments in init-post step #3519 (@mbg)
• Add support for validation jobs to sync.ts, and refactor #3541 (@mbg)
• Remove installPython from checks which should no longer need it #3549 (@mbg)
• feat: add minimumVersion values for language overlay flags #3550 (@sam-robson)
• Mergeback v4.32.6 refs/heads/releases/v4 into main #3552 (@oscarsj)
• Fix handling of non-string values from repository properties API #3557 (@mbg)
• Load custom repository properties on GHES and remove feature flag #3559 (@henrymercer)
• Clean up pre GHES 3.14 code paths #3560 (@henrymercer)
• Linting: Require unused function parameters to start with _ #3561 (@henrymercer)
• Prepare for rolling out skipping computing file coverage information on PRs #3562 (@henrymercer)
• Accept OIDC configurations in start-proxy #3563 (@mbg)
• Fix retries when uploading databases #3564 (@henrymercer)
• PR checks: Only run Go macOS tests on latest CodeQL versions #3565 (@henrymercer)
• Bump the npm-minor group with 2 updates #3566 (@henrymercer)
• Bump ava from 6.4.1 to 7.0.0 #3567 (@henrymercer)
• Fix rebuild Action #3568 (@henrymercer)
• Emit warning for unrecognised repo properties with our common prefix #3570 (@mbg)
• Add eslint for pr-checks #3572 (@mbg)
• Avoid bundling package.json in JavaScript files #3573 (@mbg)

Please do the following:

• Ensure the CHANGELOG displays the correct version and date.
• Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
• Check that there are not any unexpected commits being merged into the releases/v4 branch.
• Ensure the docs team is aware of any documentation changes that need to be released.
• Mark the PR as ready for review to trigger the full set of PR checks.
• Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.
• Merge the mergeback PR that will automatically be created once this PR is merged.
• Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.

[Copilot]

Pull request overview

This is a release PR merging main into releases/v4 for version 4.33.0. It bundles 19 individual PRs covering new features, bug fixes, internal cleanups, and dependency updates.

Changes:

• Adds file coverage deprecation warning for PRs, with opt-out via repository property or environment variable; fixes repository properties handling (array values, GHES support, unrecognized property warnings); adds OIDC auth support for the proxy.
• Fixes database upload retries, removes pre-GHES 3.14 code paths, adds per-language overlay minimum CLI versions, removes unused feature flags.
• Internal improvements: avoids bundling package.json in JS output, adds eslint for pr-checks, bumps ava to v7, removes unnecessary installPython from PR checks, and refactors sync.ts.

Reviewed changes

Copilot reviewed 135 out of 140 changed files in this pull request and generated no comments.

File	Description
CHANGELOG.md	Adds 4.33.0 release notes covering user-facing changes
package.json	Bumps version to 4.33.0, adds workspaces, updates ava/globals/sinon

Files not reviewed (1)

• pr-checks/package-lock.json: Language not supported