GeezerVison

Sets up the foundation for a comprehensive unit-test campaign on the
socket-patch CLI. No behavior change to the binary.

Two changes:

1. Expose the clap parser as a library so integration tests can verify
   the public CLI contract without spawning the binary:
   - new crates/socket-patch-cli/src/lib.rs hosting Cli, Commands,
     looks_like_uuid, and parse_with_uuid_fallback (extracted from main.rs)
   - Cargo.toml gains [lib] entry alongside the existing [[bin]]
   - main.rs is now a thin wrapper that delegates to the lib

2. De-duplicate the manifest-path resolution block that was copy-pasted
   into 5 commands (apply, rollback, list, remove, repair). New helper
   socket_patch_core::manifest::operations::resolve_manifest_path
   handles the absolute-vs-relative join in one place, with 3 unit tests.

3. New CLI_CONTRACT.md next to the crate documenting every subcommand,
   flag, default, alias, JSON shape, and exit code as semver-significant
   surface. Adds a comment block above pub enum Commands pointing to it
   so anyone editing the parser sees the contract reminder.

Verified: cargo build/clippy/test --workspace --all-features all clean
(415 unit tests pass, including 3 new resolve_manifest_path tests).

Foundation for follow-up PRs that add the per-command parser snapshot
tests and helper unit tests.

Assisted-by: Claude Code:claude-opus-4-7

Adds a #[cfg(test)] mod tests block at the bottom of
crates/socket-patch-cli/src/ecosystem_dispatch.rs covering the
partition_purls helper that splits PURLs by ecosystem and applies
the --ecosystems allow-list filter for apply/rollback/scan.

Nine cases:
  - No filter, single npm PURL groups into Ecosystem::Npm.
  - No filter, mixed npm/pypi/cargo PURLs each land in their own bucket.
  - No filter, empty input returns an empty map.
  - No filter, duplicate PURLs are preserved (no dedupe).
  - No filter, unrecognized "pkg:weirdo/..." is dropped.
  - Allow-list ["npm"] excludes pypi PURLs.
  - Allow-list ["pypi"] against an npm-only input returns empty.
  - Allow-list ["npm","pypi"] keeps both buckets.
  - Empty allow-list Some(&[]) matches nothing.

No production code changed; no filesystem-touching helpers exercised.

Verified: cargo build/clippy/test --workspace --all-features all clean
(9 new tests pass).

Assisted-by: Claude Code:claude-opus-4-7