Yarn Berry (Plug'n'Play) prints "YN0007: @datadog/pprof must be built" for
any dependency that declares an install/preinstall/postinstall script, even
the no-op "exit 0". The package ships prebuilt binaries and excludes
binding.gyp from the published tarball, so a consumer has nothing to build;
the script only suppressed npm's implicit node-gyp rebuild in the dev tree,
which CI and the prepare script do explicitly. Removing it stops the
spurious warning for Yarn Berry consumers.

Refs: DataDog/dd-trace-js#5432

…stom-labels (#347)

Port OTEP-4947 thread-context writer from polarsignals/custom-labels

Adds a Node.js writer for the OpenTelemetry Thread Local Context Record
(OTEP-4947), ported from the in-development upstream at
polarsignals/custom-labels (#16, #17).

Native addon (bindings/otel-thread-ctx.cc/.hh): the writer, namespaced
as dd::OtelThreadCtx::Init(exports) and called from binding.cc. The
thread_local discovery symbol otel_thread_ctx_nodejs_v1 stays in
extern "C" at file scope so a reader can find it by name in the
dd_pprof.node dynsym table. Records use a flexible-array tail, are
right-sized to the encoded payload (36-byte attrs_data floor, ×2
growth on append, 612-byte cap), and realloc-on-append updates the
wrapper's record_ pointer in place so every async-context frame holding
the same reference observes the new buffer. binding.gyp adds
-mtls-dialect=gnu2 on x86_64 Linux (TLSDESC; arm64 needs no flag).
Compiles across Node 18–26 (V8 ABI guards) and MSVC.

TS layer (ts/src/otel-thread-ctx.ts), Linux-only with no-op stubs
elsewhere: a ThreadContext class constructed with (traceId, spanId,
attributes?) and re-installed per async-context fire. Instance methods
enter()/run(fn) route through the prototype so only a real
ThreadContext can enter the AsyncLocalStorage; appendAttributes(),
isTruncated(), debugBytes(). Module-level getContext(), clearContext(),
and getProcessContextAttributes(keys) — the frozen OTEP-4719 snapshot
(schema version, uint8-key→name map, V8 layout constants) a reader
needs. Surfaced on the package root as require('@datadog/pprof').
otelThreadCtx.

Tests: a mocha suite (skipped on non-Linux) covering construction,
wire encoding incl. multibyte UTF-8 truncation, the cap and
isTruncated, in-place append vs realloc, async propagation,
enter/run/clearContext lifecycle, getProcessContextAttributes shape,
and a readelf check that the TLS symbol is exported correctly. A
scripts/docker/ harness + `npm run test:docker` runs the full suite in
a Linux container from any host. Verified 158 passing.

The v5.x lockfile carried newer versions than package.json declared —
a desync that lockless `yarn` never validated but `npm ci` (now used by
the lint job) rejects:

- @types/node: package.json 25.9.1 vs lock 25.9.2
- tmp: package.json 0.2.6 vs lock 0.2.7

Align package.json up to the already-locked versions rather than down:
tmp 0.2.6 carries a High-severity advisory (GHSA-7c78-jf6q-g5cm) and the
lock was already advanced to the fixed 0.2.7. This changes nothing about
what gets installed; it only makes the manifest honest. Regenerating the
lockfile also drops the stale root `hasInstallScript` flag (the install
script was removed in #363) and realigns the eslint-plugin-n / semver
range mirrors with package.json.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>