Merge release/v5-prerelease (per-command tests)

Brings in #297, which groups the CLI tests into one binary per command
and replaces the #257 oracles with golden files. It merges cleanly;
this PR's test binaries stay at the top level, as most still do.
Clippy and the policy, in-memory, parity, e2e policy, parser, help,
scan and get suites pass.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3

Author: claude

CHANGELOG.md

@@ -3328,7 +3328,7 @@ mod tests {
 
     // ---- redirectState envelope block (read-only cross-mode visibility) ----
     // The end-to-end envelope placement (report-only + agent runs carry it,
-    // hosted/vendored runs don't) is pinned by `tests/scan_invariants.rs`;
+    // hosted/vendored runs don't) is pinned by `tests/scan/scan_invariants.rs`;
     // these pin the block builder's own gates and shape.
 
     /// Pins present ⇒ the block exists with each pin's canonical purl +

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -682,10 +682,8 @@ fn unmatched_purl_exit_semantics_are_pinned() {
     assert_eq!(v2["status"], "partialFailure", "{v2}");
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// A vlt-vendored purl: `apply` yields it to the vendor ledger (the
 /// committed dir artifact is what vlt installs), leaves `.socket/`

crates/socket-patch-cli/src/commands/scan/mod.rs

@@ -39,8 +39,7 @@ use serde_json::{json, Value};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{git_sha256, parse_json_envelope, run_with_env};
 

…cket-patch-cli/tests/apply_invariants.rs …atch-cli/tests/apply/apply_invariants.rscrates/socket-patch-cli/tests/apply_invariants.rs renamed to crates/socket-patch-cli/tests/apply/apply_invariants.rs crates/socket-patch-cli/tests/apply_invariants.rs renamed to crates/socket-patch-cli/tests/apply/apply_invariants.rs

@@ -27,8 +27,7 @@
 
 use std::path::Path;
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{
     git_sha256, parse_json_envelope, run_with_env, write_blob, write_minimal_manifest, PatchEntry,