v2.11.8

<!-- Release notes generated using configuration in .github/release.yml at v2.11.8 -->

## What's Changed
### Changelog
* chore: Release Turborepo 2.11.7 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/14357
* chore: Update with-vitest example by @vercel-gh-bot-3[bot] in https://github.com/vercel/turborepo/pull/14355
* feat: Add experimental setup future flag by @anthonyshew in https://github.com/vercel/turborepo/pull/14361
* fix: Remove Bash dependency from strict environment tests by @vercel-gh-bot-3[bot] in https://github.com/vercel/turborepo/pull/14362
* fix: Use repository package manager for automatic Turbo downloads by @vercel-gh-bot-3[bot] in https://github.com/vercel/turborepo/pull/14360
* chore: Improve Factory chat and model controls by @vercel-gh-bot-3[bot] in https://github.com/vercel/turborepo/pull/14368
* chore: Add Linear connector to Factory by @vercel-gh-bot-3[bot] in https://github.com/vercel/turborepo/pull/14369
* chore: Remove HarnessAgent from Factory by @vercel-gh-bot-3[bot] in https://github.com/vercel/turborepo/pull/14370
* chore: Remove Factory UI clutter by @vercel-gh-bot-2[bot] in https://github.com/vercel/turborepo/pull/14371
* feat: Add shared platform primitives for setup and shim by @anthonyshew in https://github.com/vercel/turborepo/pull/14363
* fix: Populate task graphs for affected and filtered listings by @sahyl in https://github.com/vercel/turborepo/pull/14366
* feat: Add bounded checksum-verifying downloads by @anthonyshew in https://github.com/vercel/turborepo/pull/14374
* feat: Validate setup npm version requests by @anthonyshew in https://github.com/vercel/turborepo/pull/14375
* fix: Prune unused pnpm catalog snapshots by @vercel-gh-bot-3[bot] in https://github.com/vercel/turborepo/pull/14376
* feat: Resolve Node versions from native declarations by @anthonyshew in https://github.com/vercel/turborepo/pull/14378
* feat: Honor tool-download proxy and certificate settings by @anthonyshew in https://github.com/vercel/turborepo/pull/14379
* feat: Check bounded setup version-request overlap by @anthonyshew in https://github.com/vercel/turborepo/pull/14381
* feat: Discover setup JavaScript package-manager declarations by @anthonyshew in https://github.com/vercel/turborepo/pull/14382
* feat: Verify local artifact bytes without HTTP by @anthonyshew in https://github.com/vercel/turborepo/pull/14383
* fix: Deflake concurrent agent guidance updates by @anthonyshew in https://github.com/vercel/turborepo/pull/14388
* chore: Remove Linear from factory by @anthonyshew in https://github.com/vercel/turborepo/pull/14389
* feat: Extract verified TAR archives into private staging by @anthonyshew in https://github.com/vercel/turborepo/pull/14384
* feat: Add experimental setup command surface by @anthonyshew in https://github.com/vercel/turborepo/pull/14385
* chore: Remove Factory branch naming restrictions by @vercel-gh-bot-4[bot] in https://github.com/vercel/turborepo/pull/14391
* chore: Consolidate CI into one required summary by @anthonyshew in https://github.com/vercel/turborepo/pull/14390
* docs: Clarify task graph filter traversal by @vercel-gh-bot-2[bot] in https://github.com/vercel/turborepo/pull/14392
* feat: Extract safe Node TAR symlinks by @anthonyshew in https://github.com/vercel/turborepo/pull/14393
* feat: Infer setup roots without package managers by @anthonyshew in https://github.com/vercel/turborepo/pull/14395
* feat: Add atomic managed tool installation inventory by @anthonyshew in https://github.com/vercel/turborepo/pull/14398
* fix: Invalidate managed repositories when turbo.lock changes by @anthonyshew in https://github.com/vercel/turborepo/pull/14396
* feat: Safely extract verified ZIP archives by @anthonyshew in https://github.com/vercel/turborepo/pull/14394
* test: Add installed-wrapper process launcher by @anthonyshew in https://github.com/vercel/turborepo/pull/14401
* fix: Avoid duplicate code CI on pull request reviews by @anthonyshew in https://github.com/vercel/turborepo/pull/14414
* chore(deps): Update dependency @vercel/geistdocs to v1.28.1 by @vercel-gh-bot-4[bot] in https://github.com/vercel/turborepo/pull/14416
* docs: Remove premature setup guidance by @anthonyshew in https://github.com/vercel/turborepo/pull/14409
* feat: Validate portable setup tool resolutions by @anthonyshew in https://github.com/vercel/turborepo/pull/14400
* fix: Preserve scoped tool paths and owner-executable exports by @anthonyshew in https://github.com/vercel/turborepo/pull/14403
* fix: Preserve Node runtime failure policy provenance by @anthonyshew in https://github.com/vercel/turborepo/pull/14406
* feat: Add an internal managed-run capability query by @anthonyshew in https://github.com/vercel/turborepo/pull/14408
* feat: Verify bounded SHA-512 tool artifacts by @anthonyshew in https://github.com/vercel/turborepo/pull/14411
* test: Stabilize lockfile closure parity coverage by @anthonyshew in https://github.com/vercel/turborepo/pull/14420
* fix: Repair missing install generations and share tool readiness by @anthonyshew in https://github.com/vercel/turborepo/pull/14404
* feat: Add secure ignored setup writer storage by @anthonyshew in https://github.com/vercel/turborepo/pull/14407
* feat: Parse bounded Node release metadata by @anthonyshew in https://github.com/vercel/turborepo/pull/14410
* feat: Write setup locks atomically by @anthonyshew in https://github.com/vercel/turborepo/pull/14399
* feat: Parse bounded npm registry release metadata by @anthonyshew in https://github.com/vercel/turborepo/pull/14412
* chore: Update with-yarn example by @vercel-gh-bot-2[bot] in https://github.com/vercel/turborepo/pull/14364
* fix: Preserve unknown pnpm lockfile settings through prune by @dnalborczyk in https://github.com/vercel/turborepo/pull/14423
* fix: Preserve symlinked AGENTS.md when updating agent guidance by @drakeo338 in https://github.com/vercel/turborepo/pull/14418
* feat: Compare setup source snapshots before lock publication by @anthonyshew in https://github.com/vercel/turborepo/pull/14428
* refactor: Add fail-closed managed CLI selection by @anthonyshew in https://github.com/vercel/turborepo/pull/14413
* test: Isolate optional root initialization from watcher services by @anthonyshew in https://github.com/vercel/turborepo/pull/14427
* feat: Provision locked pnpm with managed Node launchers by @anthonyshew in https://github.com/vercel/turborepo/pull/14431
* feat: Resolve native Node.js declarations into lock selections by @anthonyshew in https://github.com/vercel/turborepo/pull/14432
* fix: Reuse healthy Node.js across managed inventory changes by @anthonyshew in https://github.com/vercel/turborepo/pull/14429
* fix: Support npm patches in pruned workspaces by @vercel-gh-bot-3[bot] in https://github.com/vercel/turborepo/pull/14434
* feat: Project selected managed execution identity by @anthonyshew in https://github.com/vercel/turborepo/pull/14430
* perf: Skip ignored directories when discovering nested .gitignore files by @withkarann in https://github.com/vercel/turborepo/pull/14442
* test: Avoid Windows CLI teardown deadlocks by @anthonyshew in https://github.com/vercel/turborepo/pull/14435
* test: Cover pnpm release-age exclusions during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/14440
* feat: Provision independently pinned npm with managed Node by @anthonyshew in https://github.com/vercel/turborepo/pull/14437
* fix: Capture setup discovery context for revalidation by @anthonyshew in https://github.com/vercel/turborepo/pull/14439
* chore: Upgrade Ghostty for Zig 0.17 by @Mearman in https://github.com/vercel/turborepo/pull/14419
* fix: Stop `add-package-names` codemod from generating duplicate names by @irontaek in https://github.com/vercel/turborepo/pull/14433
* feat: Reconcile captured JavaScript tool selections by @anthonyshew in https://github.com/vercel/turborepo/pull/14436
* chore: Release Turborepo 2.11.8-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/14453
* fix: Share setup TLS and guard official source policy by @anthonyshew in https://github.com/vercel/turborepo/pull/14438
* chore: Upgrade Next.js to 16.3.8 repo-wide for CVE-2026-94483 by @anthonyshew in https://github.com/vercel/turborepo/pull/14451
* chore: Release Turbo repository packages 0.0.1-canary.31 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/14455
* ci: Use GitHub OIDC for versioned docs aliases by @anthonyshew in https://github.com/vercel/turborepo/pull/14454
* test: Add owned setup policy fixtures for CLI tests by @anthonyshew in https://github.com/vercel/turborepo/pull/14456
* feat: Represent matching Node-bundled npm ownership by @anthonyshew in https://github.com/vercel/turborepo/pull/14457
* feat: Preserve setup lock declarations during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/14459
* refactor: Add guarded setup publication primitives by @anthonyshew in https://github.com/vercel/turborepo/pull/14460
* chore: Release Turborepo 2.11.8-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/14458
* chore: Update non-monorepo example by @vercel-gh-bot-4[bot] in https://github.com/vercel/turborepo/pull/14452
* feat: Provision frozen Node and pnpm through setup by @anthonyshew in https://github.com/vercel/turborepo/pull/14462
* fix: Exclude optional npm peers from pruned lockfiles by @anthonyshew in https://github.com/vercel/turborepo/pull/14470
* feat: Validate managed Node and pnpm readiness by @anthonyshew in https://github.com/vercel/turborepo/pull/14464
* feat: Resolve exact verified registry artifacts for setup locks by @anthonyshew in https://github.com/vercel/turborepo/pull/14465
* feat: Check installed setup tools without mutation by @anthonyshew in https://github.com/vercel/turborepo/pull/14467
* feat: Resolve captured Node and pnpm lock cohorts by @anthonyshew in https://github.com/vercel/turborepo/pull/14466
* fix: Guard setup publication plans and discovery indirections by @anthonyshew in https://github.com/vercel/turborepo/pull/14468
* fix: Release setup locks in their acquiring process by @anthonyshew in https://github.com/vercel/turborepo/pull/14472
* feat: Create and reconcile local setup locks by @anthonyshew in https://github.com/vercel/turborepo/pull/14473
* feat: Refresh managed setup locks explicitly by @anthonyshew in https://github.com/vercel/turborepo/pull/14474
* feat: Force reinstall locked setup tools by @anthonyshew in https://github.com/vercel/turborepo/pull/14475
* feat: Bind setup records to installation generations by @anthonyshew in https://github.com/vercel/turborepo/pull/14476
* chore: Update with-berry example by @vercel-gh-bot-3[bot] in https://github.com/vercel/turborepo/pull/14487
* fix: Generalize repository bootstrap across toolchains by @PedroRosalba in https://github.com/vercel/turborepo/pull/14444
* fix: Keep Go discovery stable when the repository is reached through a symlink by @PedroRosalba in https://github.com/vercel/turborepo/pull/14445
* fix: Reject non-member local sources in the uv manifest fallback by @PedroRosalba in https://github.com/vercel/turborepo/pull/14446
* fix: Hash ruff and pytest configuration between the root and uv members by @PedroRosalba in https://github.com/vercel/turborepo/pull/14447
* fix: Hash Clippy configuration for Cargo lint tasks by @PedroRosalba in https://github.com/vercel/turborepo/pull/14448
* fix: Carry uv tool configuration into pruned workspaces by @PedroRosalba in https://github.com/vercel/turborepo/pull/14449
* fix: Report inferred framework env vars for deferred tasks in dry runs by @PedroRosalba in https://github.com/vercel/turborepo/pull/14478
* docs: Explain declaring Cargo sources read from outside the crate by @PedroRosalba in https://github.com/vercel/turborepo/pull/14480
* fix: Upgrade turbo-gen Handlebars to 4.7.10 by @anthonyshew in https://github.com/vercel/turborepo/pull/14471
* chore: Add copyable Factory snapshot command by @anthonyshew in https://github.com/vercel/turborepo/pull/14481
* feat: Validate sealed native setup baselines by @anthonyshew in https://github.com/vercel/turborepo/pull/14482
* fix: Prevent Git index refresh during dirty hash collection by @anthonyshew in https://github.com/vercel/turborepo/pull/14489
* fix: Disable agent guidance by default by @anthonyshew in https://github.com/vercel/turborepo/pull/14490

## New Contributors
* @dnalborczyk made their first contribution in https://github.com/vercel/turborepo/pull/14423
* @drakeo338 made their first contribution in https://github.com/vercel/turborepo/pull/14418
* @withkarann made their first contribution in https://github.com/vercel/turborepo/pull/14442
* @Mearman made their first contribution in https://github.com/vercel/turborepo/pull/14419
* @irontaek made their first contribution in https://github.com/vercel/turborepo/pull/14433
* @PedroRosalba made their first contribution in https://github.com/vercel/turborepo/pull/14444

**Full Changelog**: https://github.com/vercel/turborepo/compare/v2.11.7...v2.11.8