Merge "Always require opt-in for root/system" into main