Merge "Enforce cross-uid touch pass-though opt-in" into main