GeezerVison

Sets up the foundation for a comprehensive unit-test campaign on the
socket-patch CLI. No behavior change to the binary.

Two changes:

1. Expose the clap parser as a library so integration tests can verify
   the public CLI contract without spawning the binary:
   - new crates/socket-patch-cli/src/lib.rs hosting Cli, Commands,
     looks_like_uuid, and parse_with_uuid_fallback (extracted from main.rs)
   - Cargo.toml gains [lib] entry alongside the existing [[bin]]
   - main.rs is now a thin wrapper that delegates to the lib

2. De-duplicate the manifest-path resolution block that was copy-pasted
   into 5 commands (apply, rollback, list, remove, repair). New helper
   socket_patch_core::manifest::operations::resolve_manifest_path
   handles the absolute-vs-relative join in one place, with 3 unit tests.

3. New CLI_CONTRACT.md next to the crate documenting every subcommand,
   flag, default, alias, JSON shape, and exit code as semver-significant
   surface. Adds a comment block above pub enum Commands pointing to it
   so anyone editing the parser sees the contract reminder.

Verified: cargo build/clippy/test --workspace --all-features all clean
(415 unit tests pass, including 3 new resolve_manifest_path tests).

Foundation for follow-up PRs that add the per-command parser snapshot
tests and helper unit tests.

Assisted-by: Claude Code:claude-opus-4-7

…iff)

Adds clap parser snapshot tests for the `scan` subcommand to lock in
every flag, short form, and default. The two load-bearing defaults
(`--batch-size = 100`, `--download-mode = "diff"`) are explicitly
asserted to catch silent regressions. Covers CSV splitting of
`--ecosystems`, all three valid `--download-mode` values, and the
expected clap error kinds for negative batch sizes and unknown flags.

Assisted-by: Claude Code:claude-opus-4-7