GeezerVison

Sets up the foundation for a comprehensive unit-test campaign on the
socket-patch CLI. No behavior change to the binary.

Two changes:

1. Expose the clap parser as a library so integration tests can verify
   the public CLI contract without spawning the binary:
   - new crates/socket-patch-cli/src/lib.rs hosting Cli, Commands,
     looks_like_uuid, and parse_with_uuid_fallback (extracted from main.rs)
   - Cargo.toml gains [lib] entry alongside the existing [[bin]]
   - main.rs is now a thin wrapper that delegates to the lib

2. De-duplicate the manifest-path resolution block that was copy-pasted
   into 5 commands (apply, rollback, list, remove, repair). New helper
   socket_patch_core::manifest::operations::resolve_manifest_path
   handles the absolute-vs-relative join in one place, with 3 unit tests.

3. New CLI_CONTRACT.md next to the crate documenting every subcommand,
   flag, default, alias, JSON shape, and exit code as semver-significant
   surface. Adds a comment block above pub enum Commands pointing to it
   so anyone editing the parser sees the contract reminder.

Verified: cargo build/clippy/test --workspace --all-features all clean
(415 unit tests pass, including 3 new resolve_manifest_path tests).

Foundation for follow-up PRs that add the per-command parser snapshot
tests and helper unit tests.

Assisted-by: Claude Code:claude-opus-4-7

Add inline #[cfg(test)] mod tests for the pure helper
find_patches_to_rollback in commands/rollback.rs covering all five
identifier paths (None, matching PURL, missing PURL, matching UUID,
missing UUID).

Add tests/cli_parse_rollback.rs locking in the public clap surface of
RollbackArgs — every long and short form, every default, optional
positional identifier (absent / UUID / PURL), --ecosystems CSV split,
and the UnknownArgument failure path. These tests parse argv through
socket_patch_cli::Cli::try_parse_from so any breaking change to the
flag contract trips them in lock-step with CLI_CONTRACT.md.

Assisted-by: Claude Code:claude-opus-4-7