Merge Main and Resolve Conflicts

Merged origin/main into attach-improvements and resolved the one conflict.

The conflict was in cmd/entire/cli/attach_test.go, where both sides had touched the same assertion in TestAttachBlocksWhenPolicyWriteUnsupported: this branch changed the runAttach call to pass a separate stderr writer, while main strengthened the assertion to check the actual error message ("checkpoint policy cannot be satisfied by this Entire CLI"). I kept both — the two-writer call signature (which matches the merged attach.go) with main's stricter assertion.

Verification: go vet is clean and all TestAttach* tests in cmd/entire/cli pass. The merge commit is 1e8484376. I didn't run the full mise run check suite — worth doing before you push.

Pushed. The first push was rejected because the remote branch had picked up a "Merge branch 'main'" commit (likely GitHub's "Update branch" button), so I merged origin/attach-improvements in — it merged cleanly and my conflict resolution in attach_test.go was untouched. Lint and the attach tests passed on the final tree, and attach-improvements is now at 064240698 on origin.