test(vex): golden snapshot of discovery over committed fixtures

Pin the exact output of lockfile discovery over every committed fixture
project, so a behavior change to discovery (or to the lock readers it
shares with the rewriters and vendor::lock_inventory) shows up as a golden
diff to review.

- Corpus: 182 projects under crates/socket-patch-core/tests/fixtures/ —
  every redirect case's input/ and expected/ tree, pnpm-hosted, poetry,
  pipenv, bun-lockb captures, and each pdm-native lock staged as pdm.lock —
  run through the full orchestrator and checked against rule 11's
  recognition-covers-refs invariant.
- Rendering (src/vex/discover/testing/golden.rs): every PatchedRef field
  (plus lockfile_basis_ok), diagnostics (tempdir root and OS error numbers
  normalized), recognized identities, unlocked pins, resolved-elsewhere
  entries, and the live hosted / vendored ledger claims. The destructuring
  is exhaustive, so a new field fails to compile until the golden covers it.
- Goldens: one JSON per fixture family (redirect-<eco>, bun-lockb,
  pdm-native, pipenv, pnpm-hosted, poetry) under
  tests/fixtures/vex-discover-golden/, mapping fixture path to output.
  Missing and orphaned entries fail.

Regenerate after an intended change with
SOCKET_PATCH_UPDATE_GOLDEN=1 cargo test -p socket-patch-core --lib
vex::discover::testing::golden. Unix only: Windows checkouts convert some
fixtures' line endings.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-core/src/vex/discover/mod.rs

@@ -116,7 +116,11 @@
 //!    bun-lockb}/…`) where they exist; include negative cases (non-Socket
 //!    host carrying a uuid, placeholder tokens, uuid-shaped grant token,
 //!    path traversal in a vendored leaf). `Project::run` asserts that every
-//!    emitted ref's uuid was recognized (rule 11).
+//!    emitted ref's uuid was recognized (rule 11). The committed fixture
+//!    projects are also pinned end to end by a golden snapshot of the full
+//!    discovery output (`testing::golden`,
+//!    `tests/fixtures/vex-discover-golden/`): an output change shows up as a
+//!    golden diff to review (`SOCKET_PATCH_UPDATE_GOLDEN=1` regenerates).
 //! 10. **Pins, not definitions; what the package manager READS.** Emit a
 //!     ref only where the file routes THIS package's resolution (a lock
 //!     entry, a `Cargo.toml` `registry = "socket-patch-<U>"`, a nuget
@@ -1969,6 +1973,8 @@ pub(crate) mod testing {
 
     use super::{DiscoverCtx, Discovery, Recognized, WiringMode};
 
+    pub(crate) mod golden;
+
     /// Canonical patch uuids for fixtures.
     pub(crate) const UUID_A: &str = "7c8d9e0f-1a2b-4a1b-8c2d-3e4f5a6b7c8d";
     pub(crate) const UUID_B: &str = "0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d";