* Update README

* PR comments

#23564)

* gpu: clarify metric descriptions, add missing units, mark deprecated aliases

Improve metric metadata for the GPU integration so consumers (humans and
automated agents) can tell related metrics apart and understand each
metric's scope without external lookups:

- sm_active / sm_utilization / gr_engine_active: explain temporal vs
  spatial measures and reference NVML sources so callers pick the right
  metric for ML/compute vs rendering workloads.
- device.total: add unit (device) and aggregation guidance.
- device.unhealthy: define what "unhealthy" means and the 0/1 encoding.
- errors.xid.total: add unit (error) and document the origin/type tags.
- memory.limit: explain how scope changes with pid/container_id tags.
- nvlink.speed: clarify it is the negotiated common link speed and
  reference the NVML field.
- decoder_utilization, encoder_utilization, process.decoder_utilization,
  process.encoder_utilization: mark deprecated and point to the *_active
  replacements introduced in Agent 7.77 (EBPF-1041).
- nvlink.count.{active,inactive,total}: fill in missing short_name.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Clarify GPU metric metadata descriptions

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Guillermo Julián <guillermo.julian@datadoghq.com>
Co-authored-by: Guillermo Julián <gjulianm@users.noreply.github.com>

* Finalize Agent release 7.80.2

* Remove datadog-snowflake 7.13.0 entries from Agent 7.80.x sections.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Kyle-Neale <37895372+Kyle-Neale@users.noreply.github.com>
Co-authored-by: Kyle-Neale <kyle.neale@datadoghq.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* Load the security module only when a check needs it

Importing datadog_checks.checks always pulls in the security module
(datadog_checks.base.utils.models.validation.security), which accounts for about
1 MiB of memory, even for checks that never use it. Now it's lazy loaded, so the
security module is only loaded on use. That saves about 1 MiB for checks that
don't need it, with no change for the ones that do.

* Add changelog entry for PR

* cherry pick

* changelog

* lint

)

Switch the default V2_REPOSITORY_URL from the direct S3 REST endpoint to
the CloudFront entrypoint that fronts the agent-integration-wheels-prod
public bucket:

    https://agent-integration-wheels-prod.s3.amazonaws.com
  ->
    https://agent-integration-wheels-prod.datadoghq.com

The CloudFront distribution is defined in DataDog/cloud-inventory at
datacenters/us1.prod.dog/agent-integration-wheels/. It is a pass-through
in front of the same bucket, anonymous reads only, so the bucket's
existing public-access policy (scoped to wheels/*, attestations/*,
targets/*, metadata/*) is still the sole authorization boundary.

Behavior is unchanged from the caller's perspective:
- '--repository' continues to accept any HTTPS base URL, so users can
  still target the direct S3 endpoint or any other mirror.
- Pointer files keep their informational 'repository' field; the
  downloader always fetches wheels relative to the URL passed at
  construction time (covered by
  test_repository_flag_overrides_pointer_repository).

Updates the unit tests to use the corresponding CloudFront URLs so the
fixtures match the production defaults.

Deployment note: the CloudFront infra must be deployed and validated
from the cloud-inventory change before this default flip rolls out to
agents.

[checks_downloader] point at single agent-integration-wheels CDN URL

Update V2_REPOSITORY_URL to the single stable public hostname now
exposed by the cloud-inventory CloudFront distribution:

    https://agent-integration-wheels.datadoghq.com

This is the only public CDN entrypoint we maintain for the wheel
publishing pipeline. The staging bucket is no longer fronted by its
own CDN; if the prod bucket ever needs to be failed over (corruption,
rollback, etc.), the cloud-inventory operators can repoint this same
hostname at the staging bucket without requiring a downloader release.

The override regression test now uses the direct S3 endpoint as the
"different repository in the pointer" so it more obviously represents
a realistic break-glass override.

Trim redundant comments from downloader v2 URL change

Add changelog fragment for the v2 repository URL change

Co-authored-by: bits <bits@datadoghq.com>

* Bump cryptography from 46.0.7 to 48.0.1

Fixes: VULN-86324 (GHSA-537c-gmf6-5ccf / CVE-2026-34180)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Add changelog entries for cryptography 48.0.1 bump

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Bump pyopenssl from 26.0.0 to 26.2.0 to allow cryptography 48.x

pyopenssl 26.0.0 caps cryptography at <47; 26.2.0 supports cryptography
<49,>=46.0.0 — required so the cryptography 48.0.1 bump resolves.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Update dependency resolution

* Make TLS cert-parse-error test robust to cryptography version

cryptography 48.0.1 changed the cffi error wording from "object cannot
be converted to 'PyBytes'" to "object is not an instance of 'bytes'".
Match only the check's stable message prefix so the assertion no longer
breaks across cryptography bumps.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Update dependency resolution

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: dd-agent-integrations-bot[bot] <dd-agent-integrations-bot[bot]@users.noreply.github.com>