GeezerVison

Summary

Three independent hardening fixes in socket-patch-core:

• read_manifest error propagation (MEDIUM-2): Non-NotFound I/O errors (permissions, disk failures) and JSON parse/validation errors are now propagated as Err instead of silently mapped to Ok(None). Users see the real error ("Permission denied") instead of the misleading "Invalid manifest".
• Blob hash verification at download (LOW-1): download_hashes now computes git_sha256 on downloaded content and verifies it matches the expected hash before writing to disk. Corrupt downloads are rejected with a "Content hash mismatch" error.
• --force + all NotFound reporting (MEDIUM-1): apply_package_patch now distinguishes all-AlreadyPatched from all-NotFound-skipped. When every file is NotFound under --force, the result is still success: true (to not break CI) but includes an informational error message: "All patch files were skipped: N not found on disk (--force)".

Test plan

• cargo check --workspace --all-features compiles
• cargo test -p socket-patch-core passes (255 tests)
• cargo test -p socket-patch-cli passes
• Manual: make manifest file read-only, run apply — should show real permission error
• Manual: run apply --force against a package where all files are missing — should succeed but show skip message

🤖 Generated with Claude Code