v5 tests: one suite per command, retire #257 oracles (#297)

* Pin the #257 oracle sweeps with golden digests

The randomized equivalence sweeps that compare the blocking-pool
crawlers and single-pass rewriters with their pre-#257 oracles now
also record, per case, a digest of the generated input and of the
output both implementations agreed on, in
crates/socket-patch-core/tests/equivalence/*.golden. The oracles
still run, so every recorded output is proven equal to the oracle's.
The next commit deletes the oracles and keeps the goldens.

The crawler goldens were blessed on Linux as a non-root user: the
sweeps strip permissions and plant symlinks, so they replay only
there (other platforms and root still run the sweeps, without the
golden comparison).

Also moves the crawler sweeps' xorshift test RNG to
crate::test_rng, and renames crawlers::oracle_support to
crawlers::test_tree.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

* Retire the #257 crawler and rewriter oracles

The equivalence sweeps now replay against the golden digests pinned
in the previous commit instead of re-running the verbatim previous
implementations: the crawler oracles (cargo, composer, go, maven,
npm, nuget, python), the hosted rewriter oracles and the reference
POM parser are deleted. Every sweep still generates the same inputs
from the same seeds, so a changed output is still caught per case.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

* Pin the pdm and poetry rewrites by golden

The pdm plan, pdm and poetry parse-reuse rewrites were checked
against #257's verbatim fresh-parse implementations. Their sweeps
now record per-case digests, blessed while those oracles still
agreed with production, and the oracles are deleted.

Golden keys with whitespace are normalized so a case label can
never split a golden line.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

* Merge 67 CLI test binaries into command suites

The subprocess-only integration tests for apply, get, remove,
rollback, repair, scan, vendor, update and the global CLI now build
as one binary per command instead of 67, so CI links and runs 58
fewer test binaries. Each file keeps its name as a module, and the
shared helpers are declared once per suite, so their self-tests run
once per suite instead of once per file.

Binaries a workflow names, the docker e2e suites, crawl_fd_limit_e2e
and the in-process suites (which share process-global notice and
config state) stay separate. Doc links to the moved files are
updated.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

* Point docs at the merged test suites

Rows that named a moved test binary now name its suite and module.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

* Keep the crawler oracles

A crawler's output follows the directory order the filesystem hands
back, which differs between filesystems: every crawler golden blessed
on ext4 failed when replayed on tmpfs, and macOS and Windows skipped
them. The per-call oracles walk the same tree as the crawler, so they
check the parallel walk on every platform; restore them and drop the
crawler goldens. The rewriter goldens are pure text and stay.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

CHANGELOG.md

@@ -3243,7 +3243,7 @@ mod tests {
 
     // ---- redirectState envelope block (read-only cross-mode visibility) ----
     // The end-to-end envelope placement (report-only + agent runs carry it,
-    // hosted/vendored runs don't) is pinned by `tests/scan_invariants.rs`;
+    // hosted/vendored runs don't) is pinned by `tests/scan/scan_invariants.rs`;
     // these pin the block builder's own gates and shape.
 
     /// Pins present ⇒ the block exists with each pin's canonical purl +

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -682,10 +682,8 @@ fn unmatched_purl_exit_semantics_are_pinned() {
     assert_eq!(v2["status"], "partialFailure", "{v2}");
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// A vlt-vendored purl: `apply` yields it to the vendor ledger (the
 /// committed dir artifact is what vlt installs), leaves `.socket/`

crates/socket-patch-cli/src/commands/scan/mod.rs

@@ -39,8 +39,7 @@ use serde_json::{json, Value};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{git_sha256, parse_json_envelope, run_with_env};
 

…cket-patch-cli/tests/apply_invariants.rs …atch-cli/tests/apply/apply_invariants.rscrates/socket-patch-cli/tests/apply_invariants.rs renamed to crates/socket-patch-cli/tests/apply/apply_invariants.rs crates/socket-patch-cli/tests/apply_invariants.rs renamed to crates/socket-patch-cli/tests/apply/apply_invariants.rs

@@ -27,8 +27,7 @@
 
 use std::path::Path;
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{
     git_sha256, parse_json_envelope, run_with_env, write_blob, write_minimal_manifest, PatchEntry,