Keep patch uuids out of bundled-copy diagnostics

CodeQL flagged the new bun and vlt bundled-copy diagnostics for
printing the patch uuid. They now name only the package, matching
the other recent VEX diagnostics.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-core/src/vex/discover/bun.rs

@@ -192,11 +192,11 @@ impl Bundled {
                 DIAG_REF_UNATTRIBUTABLE,
                 file,
                 format!(
-                    "{file}: {label}: {} is wired to Socket patch {}, but bun installs this \
+                    "{file}: {label}: {} is wired to a Socket patch, but bun installs this \
                      entry as a bundled dependency, unpacked from the parent package's \
                      tarball that no rewire reaches, so that copy stays unpatched; the patch \
                      is not attested",
-                    r.purl, r.uuid,
+                    r.purl,
                 ),
             );
             purls.push(r.purl);
@@ -229,12 +229,12 @@ impl Bundled {
                 DIAG_REF_UNATTRIBUTABLE,
                 file,
                 format!(
-                    "{file}: {} is wired to Socket patch {} but {file} also installs a bundled \
+                    "{file}: {} is wired to a Socket patch but {file} also installs a bundled \
                      copy of it at {label:?} (bun unpacks bundled dependencies from the parent \
                      package's tarball, so no rewire reaches it and that copy stays unpatched); \
                      the patch is not attested while the build ships unpatched bytes of this \
                      version",
-                    r.purl, r.uuid,
+                    r.purl,
                 ),
             );
         }

crates/socket-patch-core/src/vex/discover/vlt.rs

@@ -267,12 +267,12 @@ async fn contest_bundled_copies(ctx: &DiscoverCtx<'_>, nodes: &[VltLockNode], ou
             DIAG_REF_UNATTRIBUTABLE,
             VLT_LOCK,
             format!(
-                "{VLT_LOCK}: {} is wired to Socket patch {} but vlt also installs a bundled \
+                "{VLT_LOCK}: {} is wired to a Socket patch but vlt also installs a bundled \
                  copy of it at {location:?} (vlt unpacks bundled dependencies from the parent \
                  package's tarball and records no lock node for them, so no rewire reaches it \
                  and that copy stays unpatched); the patch is not attested while the build \
                  ships unpatched bytes of this version",
-                r.purl, r.uuid,
+                r.purl,
             ),
         );
     }