A per-run .npmrc in every build context put a changing credential in COPY . . of modules that resolve no mesh package — a non-deterministic image (a needless rollout every build, which recreated the control plane) and a credential in a build stage. Now it is written only for a package artifact or an image whose Dockerfile names .npmrc. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx