test(e2e_vex_build): poetry vendored capstone asserts the manifest-free ledger

The poetry vendored capstone (added in #251, written before its rebase onto
#247) still asserted `scan --vendor` writes `.socket/manifest.json`. Since
#247 vendored mode is manifest-free (CLI_CONTRACT `scan --vendor`): the run
writes only `.socket/vendor/**`, and each ledger entry is `detached: true`
with the patch record embedded. The assertion therefore failed on every
Poetry release in the CI matrix the first time the leg actually ran (#253).

Assert the contract instead: no manifest is written, and the ledger entry
for the vendored uuid is detached and embeds its record.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/tests/e2e_vex_build/poetry.rs

@@ -9,8 +9,9 @@
 //!    written, the same-run VEX attests from the lock's sha256 pin); vendored
 //!    = `scan --vendor --vendor-source build --vex` over the pristine
 //!    install (the patched wheel is committed under
-//!    `.socket/vendor/pypi/<uuid>/`, the lock is rewired to it, manifest +
-//!    ledger are written);
+//!    `.socket/vendor/pypi/<uuid>/`, the lock is rewired to it, and only the
+//!    ledger is written — vendored mode is manifest-free, so the ledger
+//!    entry is detached and embeds the patch record);
 //! 3. a FRESH checkout of only the committable files (`pyproject.toml`,
 //!    `poetry.lock`, `.socket/`) is installed by the real `poetry install`
 //!    and the imported `six` is proven to be the PATCHED bytes (vendored
@@ -924,8 +925,25 @@ fn poetry_vendored_fresh_install_then_manifestless_vex() {
         lock.contains(&wheel_sha),
         "the lock pins the committed wheel:\n{lock}"
     );
-    assert!(project.join(".socket/manifest.json").is_file());
-    assert!(project.join(".socket/vendor/state.json").is_file());
+    // Vendored mode is manifest-free (v5.0, CLI_CONTRACT `scan --vendor`):
+    // the ledger entry is detached and embeds the patch record, and
+    // `.socket/manifest.json` is never written.
+    assert!(
+        !project.join(".socket/manifest.json").exists(),
+        "vendored scan wrote a manifest: {env}"
+    );
+    let ledger: Value = serde_json::from_slice(
+        &std::fs::read(project.join(".socket/vendor/state.json")).expect("vendor ledger written"),
+    )
+    .unwrap();
+    let entry = ledger["entries"]
+        .as_object()
+        .into_iter()
+        .flat_map(|m| m.values())
+        .find(|e| e["uuid"] == VENDORED_UUID)
+        .unwrap_or_else(|| panic!("no ledger entry for {VENDORED_UUID}: {ledger:#}"));
+    assert_eq!(entry["detached"], true, "{ledger:#}");
+    assert_eq!(entry["record"]["uuid"], VENDORED_UUID, "{ledger:#}");
     let doc: Value = serde_json::from_slice(&std::fs::read(&embedded).unwrap()).unwrap();
     assert_attested(
         &doc,