Structure-review batch: sweep fixes, module taxonomy, npm-family dedup, coverage gaps, CI honesty - #150

Bug fixes
- scan --prune now exempts manifest entries whose ecosystem this run never
  crawled: an unknown `pkg:<type>/` (a newer CLI's ecosystem in a committed,
  shared manifest) and the runtime-gated maven/nuget crawlers with their gate
  off. Absence from a crawl that never looked is not evidence of removal, so
  pruning them silently deleted a teammate's patch plus its blobs.
- get: thread --api-token/--api-url/--org/--proxy-url into the nested apply.
  They were dropped, so a token supplied purely as a flag fell through to the
  token-less public proxy — against the wrong host, with the wrong client.
- redirect: write the managed `[registries.…]` block into the legacy
  extensionless `.cargo/config` when a project carries it. Cargo reads that
  spelling in preference to `config.toml`, so the block was landing in a file
  cargo ignores while the run still reported the dep redirected.
- rollback: fall back to dropping the go.mod `replace` + `.socket/go-patches/`
  copy for a local-mode go patch whose module the crawler cannot find.
- crawlers: composer reads `installed.json` through `open_regular_file` (a
  planted FIFO no longer hangs scan/apply forever); maven treats an empty
  MAVEN_REPO_LOCAL/M2_HOME as unset; nuget matches `nuget.config` /
  `packages.config` case-insensitively; python scans the macOS
  `osx_framework_user` user-install root; ruby's local-mode fallback returns
  every gem home `gem env` reports (not just `gemdir`) and accepts the
  alternate `gems.rb`/`gems.locked` Bundler spelling.
- setup: `--exclude` trims CSV whitespace and covers the excluded directory's
  whole subtree; `finalize_gem` forwards an absolutized --manifest-path.
- update: non-fatal advisories ride the envelope's run-level `warnings[]`, so
  a `--json` run no longer silently swallows a managed-install override.
- vex: git-config parsing matches git itself (case-insensitive names, BOM
  tolerance, whitespace before a quoted subsection).
- lib: `--update=<VERSION>` (inline `=` spelling) is recognized, and a
  `--update` after `--` is correctly left as an escaped operand.

Test harness / CI
- New [profile.ci-release] (release minus the full-LTO link) for test-release,
  and dependency opt-levels raised in the dev profile — the self_update
  fixtures gzip and sha256 a multi-MB binary per test at opt-level 0.
  Workspace members stay at opt-level 0, so llvm-cov line fidelity and debug
  experience are unchanged.
- CI: per-job timeout-minutes, and a concurrency group that supersedes stale
  runs while never cancelling main (main is the only rust-cache writer).
- The two wall-bound real-package-manager redirect capstones are
  #[ignore]-gated out of the serial `test` job and relocated to the parallel
  e2e matrix, which runs `-- --ignored` on all three OSes. Same coverage, off
  the critical path.
- Drop the unused testcontainers dev-dependency (-1001 Cargo.lock lines).
- Many new invariant/e2e suites: scan, apply, remove, setup, vendor, vex,
  crawlers, in-process redirect, CLI config fallback.

Known-RED tests, gated with #[ignore] and a reason
Each of these is a correct test for a real bug whose production fix is NOT in
this change. They are gated rather than deleted so the finding is not lost:
apply_lock waiter/orphaned-inode (two simultaneous holders of the "exclusive"
apply lock), apply's manifest_unreadable fail-closed arm, the telemetry
--api-url/--proxy-url env mirror (on-prem token egress), composer.json setup
mode preservation (one-line fix: use atomic_write_bytes_preserving_mode),
pnpm `node-linker=pnp` detection, pnpm workspace flow-sequence parsing,
apply's cached-package-archive fallback, remove's ledger-generation match,
and the yarn-PnP refusal scoping (its counter-guard stays live).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…treat empty CARGO_HOME as unset

Two more fixes the sweep's own RED regression tests were pinning:

* scan --vendor --json: reconcile_dropped mutates the on-disk ledger
  BEFORE staging, but a staging failure returned Err without the
  envelope — the JSON consumer saw only the error object and never
  learned entries had been reverted on disk. The step error now carries
  the envelope built so far and the JSON fold attaches it as `vendor`.
  (Human mode prints no per-event lines even on success; unchanged.)

* cargo crawler: CARGO_HOME="" hit PathBuf::from("") and resolved
  registry/src against the CWD, silently crawling nothing. Empty now
  means unset (env_non_empty convention), falling back to ~/.cargo.

Pinned by scan_vendor_staging_error_still_reports_the_reconcile and
empty_cargo_home_falls_back_to_home_dot_cargo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Pure move, no logic changes. patch/ was 63% of the crate but only ~11%
patch engine; the vendoring + lockfile-rewriting subsystem it contained
(34 files, ~47% of core) is the crate's real center of mass and now
lives at crate::vendor. The npm-family strays move with it
(bun_lock_text, go_mod_edit), and the project-local Go replace-redirect
backend joins the other rewiring code as patch::redirect::golang_local.

Old `patch::*` paths keep compiling through re-export shims for
external consumers of the published crate; internal references are
repointed in the follow-up commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Four naming schemes for one concept, now one umbrella: gem_setup ->
setup::gem, composer_setup -> setup::composer, pth_hook -> setup::pypi,
plus a thin setup::npm alias re-exporting package_json's setup-facing
surface. package_json itself stays top-level: it doubles as the
crate-wide shared npm-manifest library (crawlers and vendor parse
package.json through it), which is exactly why it never fit under a
setup umbrella wholesale.

Pure git-mv moves — the pypi backend's generic TOML helpers were already
extracted to utils::toml_edit_ext, so nothing vendor-shaped rides along.
Old top-level paths keep compiling through lib.rs aliases for external
consumers of the published crate; internal references are repointed and
the CI alias-path grep now rejects the three old paths. The shared
per-backend Status enum the four modules' docs describe informally is
deliberately NOT introduced here: their status semantics differ subtly
(gem template regeneration), and unification is a behavior decision,
not motion.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ken by the setup/ move

Two CI reds from the consolidated branch's first run, plus doc-path rot:

* e2e_composer's scan tests were designed offline ("the package count is
  derived from the local crawl") but implicitly called the LIVE public
  proxy — their exit-0 assumption dated from before the
  all-batches-failed fix made total API failure exit non-zero, so any
  production hiccup (like today's patches-api 503 "over capacity"
  incident) failed the test, coverage and test-release jobs on every OS.
  Now pinned to an in-test wiremock proxy with the same harness shape as
  e2e_nuget/e2e_gem (empty no-patch result, env scrub, spawn_blocking,
  request-count hermeticity guard). e2e_embedded_vex audited too: its
  scans find zero packages, so no API call fires — left as is.

* lint-ecosystems ruby-checked the gem templates at their pre-move path;
  the setup/ umbrella relocated them to src/setup/gem/templates/ and the
  Rust-path CI grep could not catch a filesystem path in a workflow.
  Also: release.yml's gem_setup comment and CLI_CONTRACT.md's
  src/patch/vendor/ references updated to the new module homes (the only
  stale non-Rust references a repo-wide sweep found).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… status, dead Err plumbing removed — with the pins the review demanded

Review follow-ups (2026-08-11 ULTRACODE pass over #150):

* detect_updates: the qualifier-stripped fallback did HashMap iter().find(),
  so qualifier TWINS (one package under two artifact-pinned manifest keys,
  e.g. a pypi wheel+sdist pair) resolved to a per-process-random record.
  Now: any stale twin means an update; twins scan in sorted-key order and
  the first differing one names old_uuid — deterministic across runs. New
  pins: the qualifier-bridge leg (previously only percent-encoding was
  tested) and the twin cases (stale twin wins over 16 iterations; all-twins-
  current stays quiet).

* scan --vendor --json: the envelope carried into the staging-error fold is
  now demoted to partialFailure before the carry — a consumer reading
  .vendor.status inside a "status":"error" result saw the fresh-envelope
  default "success". Pinned in scan_vendor_step_error_e2e.

* stage_vendor_sources_in_memory returns MemStageOutcome directly: it never
  constructed Err, so the Result wrapper bred statically-dead stage_failed
  arms in three callers (scan flow, vendor, repair_vendor) — all removed.

* Hosted --json write-failure bail-outs (legs 3-4: unwritable lockfile,
  directory squatting on the revert-ledger path) get the envelope test the
  882cdb7 commit message claimed — driven with real filesystem
  obstructions, cross-platform via set_readonly.

* get nested apply: a token-less --proxy-url-only leg. The two
  authenticated legs could not catch a dropped proxy_url (the client
  consults it only on the token-less branch); this leg goes red for
  exactly that regression.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>