Merge release/v5-prerelease (test suites)

Brings in #297, which groups the CLI tests into one binary per command
and replaces the oracle comparisons with golden files. The merge had
no conflicts. This branch's own suites stay separate binaries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AvGSu5jGg1z3f3sePc2eHC

Author: claude

CHANGELOG.md

@@ -3566,7 +3566,7 @@ mod tests {
 
     // ---- redirectState envelope block (read-only cross-mode visibility) ----
     // The end-to-end envelope placement (report-only + agent runs carry it,
-    // hosted/vendored runs don't) is pinned by `tests/scan_invariants.rs`;
+    // hosted/vendored runs don't) is pinned by `tests/scan/scan_invariants.rs`;
     // these pin the block builder's own gates and shape.
 
     /// Pins present ⇒ the block exists with each pin's canonical purl +

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -682,10 +682,8 @@ fn unmatched_purl_exit_semantics_are_pinned() {
     assert_eq!(v2["status"], "partialFailure", "{v2}");
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// A vlt-vendored purl: `apply` yields it to the vendor ledger (the
 /// committed dir artifact is what vlt installs), leaves `.socket/`

crates/socket-patch-cli/src/commands/scan/mod.rs

@@ -39,8 +39,7 @@ use serde_json::{json, Value};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{git_sha256, parse_json_envelope, run_with_env};
 

…cket-patch-cli/tests/apply_invariants.rs …atch-cli/tests/apply/apply_invariants.rscrates/socket-patch-cli/tests/apply_invariants.rs renamed to crates/socket-patch-cli/tests/apply/apply_invariants.rs crates/socket-patch-cli/tests/apply_invariants.rs renamed to crates/socket-patch-cli/tests/apply/apply_invariants.rs

@@ -27,8 +27,7 @@
 
 use std::path::Path;
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{
     git_sha256, parse_json_envelope, run_with_env, write_blob, write_minimal_manifest, PatchEntry,