CI: scan suite covgap files get real homes (#1089)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #1089 (scan/ slice of child 6; the issue stays open for the core crate's covgap_* files, and #1580 covers update/)

Summary

The scan test binary still carried four coverage-gap files, and two of them tested other commands. This PR moves each test to a named home:

Old	New
scan/covgap_ecosystem_dispatch.rs (deno apply + rollback dispatch, adapted copies of another file's oracles)	ecosystem_dispatch_e2e.rs::dispatch_branch_deno / rollback_dispatch_branch_deno, using that file's shared oracles. RollbackFixture.global: bool becomes scope_args so deno can pass --global-prefix
scan/covgap_commands_fetch_stage.rs offline no-local-source report	apply/apply_render.rs: one render check (header total, five distinct purls listed, ... and N more, repair remedy). The existing --json test in apply_silent_staging_errors.rs now also checks the offline_missing_sources warning code (no CLI test asserted it before), applied == 0, and an unchanged manifest and .socket/blobs
scan/covgap_commands_fetch_stage.rs cold-cache online apply	The fetch behavior (blob-only requests, applied, nothing in .socket/blobs) is already in apply/apply_network.rs. What stays is one render check in apply_render.rs: the result line on stderr, no permanent progress, nothing on stdout
scan/coverage_fix_scan_discovery_corrupt_ledger.rs	scan/scan_prune_corrupt_vendor_ledger.rs (already --json; now parses through common::envelope)
scan/covgap_commands_scan_vendor_flow.rs	scan/scan_vendor_flow.rs (already --json; every envelope now parses through common::envelope)

apply_fixture.rs gets one shared write_sourceless_npm_patches(root, n), which replaces apply_silent_staging_errors.rs's private copy. No product code changes.

CI cost: test-only. A lean PR run is unchanged: about 28 Linux jobs and ~8 min, before and after, with no new test binary. Six moved tests become six checks, plus stronger assertions on one existing test. All are local or wiremock and take under a second each.

Test evidence

• cargo test -p socket-patch-cli --all-features --test scan --test apply --test ecosystem_dispatch_e2e: 241 + 148 (1 ignored, pre-existing) + 43 passed, three runs in a row.
• cargo fmt --all -- --check and cargo clippy --locked --workspace --all-features -- -D warnings are clean. Clippy with --tests on these three binaries reports 33 lints both before and after this PR. They are pre-existing (file is loaded as a module multiple times, …) and none is in a line this PR adds.
• CI on 1e87433: all 86 checks finished with no failures, and ci-ok passed. Bugbot found no issues.
• This PR moves tests, so there is no red→green regression test.

/code-review high findings

All seven fixed in 1e87433:

• The vacuous node_modules/miss-0 check is gone. The offline bail now checks the manifest bytes and .socket/blobs.
• The duplicate --json offline test was dropped. Its new assertions moved into the existing apply_json_offline_missing_source_keeps_stderr_clean. That test's warnings check is "contains offline_missing_sources, not sources_download_failed", not exact equality.
• There is now one sourceless-manifest fixture, and it returns (). The render check matches listed lines against the fixture purls. The order isn't pinned because the report lists purls in hash order.
• scan_vendor_flow.rs::assert_vendor_step_error uses parse_json_envelope. The deno apply runner takes (String, String) env, like run_rollback.

🤖 Generated with Claude Code

https://claude.ai/code/session_018CDpmXSF81omP1jGKngH54

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1e87433. Configure here.}