GeezerVison

Sets up the foundation for a comprehensive unit-test campaign on the
socket-patch CLI. No behavior change to the binary.

Two changes:

1. Expose the clap parser as a library so integration tests can verify
   the public CLI contract without spawning the binary:
   - new crates/socket-patch-cli/src/lib.rs hosting Cli, Commands,
     looks_like_uuid, and parse_with_uuid_fallback (extracted from main.rs)
   - Cargo.toml gains [lib] entry alongside the existing [[bin]]
   - main.rs is now a thin wrapper that delegates to the lib

2. De-duplicate the manifest-path resolution block that was copy-pasted
   into 5 commands (apply, rollback, list, remove, repair). New helper
   socket_patch_core::manifest::operations::resolve_manifest_path
   handles the absolute-vs-relative join in one place, with 3 unit tests.

3. New CLI_CONTRACT.md next to the crate documenting every subcommand,
   flag, default, alias, JSON shape, and exit code as semver-significant
   surface. Adds a comment block above pub enum Commands pointing to it
   so anyone editing the parser sees the contract reminder.

Verified: cargo build/clippy/test --workspace --all-features all clean
(415 unit tests pass, including 3 new resolve_manifest_path tests).

Foundation for follow-up PRs that add the per-command parser snapshot
tests and helper unit tests.

Assisted-by: Claude Code:claude-opus-4-7

Adds tests/cli_parse_list.rs covering the public contract for `socket-patch
list`:
- clap parser tests pin each ListArgs flag (long + short forms), assert the
  defaults from CLI_CONTRACT.md, and verify unknown flags surface
  ErrorKind::UnknownArgument.
- async run() tests exercise the no-network branches against tempdirs:
  missing manifest (exit 1, plain + json), empty manifest (exit 0, plain +
  json), populated manifest (exit 0, plain + json), and an absolute
  --manifest-path overriding --cwd.
- one subprocess test invokes the compiled binary against a missing-manifest
  tempdir with --json and parses stdout to lock the
  { status: "error", error: "Manifest not found", path: ... } shape, since
  run() writes to the real stdout and cannot be captured in-process.

Assisted-by: Claude Code:claude-opus-4-7