GeezerVison

Adds a new `socket-patch vex` subcommand that emits an OpenVEX 0.2.0
document derived from the local manifest. Each statement reports the
top-level product as `not_affected` by a given vulnerability with
justification `inline_mitigations_already_exist`, pointing at the
patched dependency as a subcomponent.

Design highlights:
- New self-contained module `socket-patch-core::vex` (schema, build,
  product detection, on-disk verify, RFC 3339 time). No openvex crate
  dependency — those are unmaintained.
- One statement per vulnerability ID. GHSA becomes `name`, CVEs become
  `aliases`. Two patches that fix the same GHSA merge their
  subcomponents into one statement.
- Auto-detects the product PURL from package.json > pyproject.toml >
  Cargo.toml. `--product` overrides.
- On-disk hash verification is the default; `--no-verify` skips it.
  Patches that fail verification are silently omitted from the
  document (never emitted as `affected` or `under_investigation`) and
  surfaced as stderr warnings / `--json` envelope `skipped` events.
- Exit 0 on success, 1 on no-applicable-patches, 2 on hard errors
  (manifest unreadable, `--json` without `--output`, etc.).

CI installs Go + vexctl before the test step; `tests/e2e_vex.rs`
runs `vexctl inspect` against the generated document whenever the
binary is on PATH. Local devs without Go see a skip message.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Org policy (and zizmor) require all action references to use a
40-char SHA pin. Resolved via
`gh api repos/actions/setup-go/git/refs/tags/v6.4.0`.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Adds git-remote-origin detection as the top-priority signal in
vex::product::detect_product. The repo is usually the canonical
product identifier when it's a git checkout; package.json /
pyproject.toml / Cargo.toml become fallbacks.

Format:
- [email protected]:owner/repo.git    → pkg:github/owner/repo
- https://github.com/owner/repo    → pkg:github/owner/repo
- gitlab.com / bitbucket.org       → pkg:gitlab|bitbucket/owner/repo
- self-hosted / unknown forge      → raw URL (OpenVEX @id accepts any URI)

Walks ancestors of cwd looking for `.git/config`, so subdir invocations
(common in monorepos) still resolve correctly. SSH (`git@...`),
`ssh://`, `git://`, `git+ssh://`, `http(s)://` all parse to host+path.

Also fixes the vexctl integration: `vexctl inspect` doesn't exist at
v0.3.0; switched to `vexctl list` which loads and parses the document
and exits non-zero on malformed input — the de facto schema gate.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

`vexctl list <arg>` parses <arg> as a selector (status / justification),
not a file path. Switch to `vexctl merge --files <path>` which loads,
parses, and re-emits the document — the canonical single-file parse
gate at vexctl v0.3.x. A successful merge proves the input is valid
OpenVEX; we additionally assert the output round-trips through serde
as JSON.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

`vexctl merge` accepts file paths positionally, not via `--files`.
Verified locally with vexctl v0.3.0:

    $ vexctl merge ./out.vex.json
    { ... merged document ... }

Exit 0 with our generated doc confirms parse + schema validation
against the OpenVEX 0.2.0 spec.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

…ompleteness

Drives line coverage of `socket-patch-core::vex` to ~99.7% (1846/1851
lines covered) and locks down OpenVEX 0.2.0 spec conformance.

Schema additions (all `Option<T>`, all `skip_serializing_if = "Option::is_none"`,
no change to what the builder emits today):
- `Document.role`, `Document.last_updated`
- `Statement.@id`, `Statement.last_updated`, `Statement.supplier`,
  `Statement.action_statement`
- `Product.identifiers`, `Product.hashes`
- `Subcomponent.identifiers`, `Subcomponent.hashes`
Backwards-compatible: existing docs round-trip unchanged; new fields
appear only when callers set them.

Test count went from 33 to 144 across the vex module (+111 tests):
- schema.rs:  6 → 24 — every Status/Justification variant, all new
              optional fields, missing-required-field rejection,
              version typing, multi-aliases ordering.
- build.rs:   7 → 17 — applied PURL not in manifest, zero-vuln patch,
              empty CVE list, duplicate CVE dedup, tooling=None,
              empty author, determinism, timestamp consistency,
              subcomponent sort order.
- product.rs: 22 → 53 — `[tool.poetry]` fallback, CRLF git config,
              all URL scheme branches (git+ssh, git://, http://,
              port-suffix, no-user), no-origin/empty-url config
              fallbacks, multi-manifest combos beyond pkg+cargo,
              non-string JSON name/version, missing-version-key,
              parse_toml_kv negative cases, three-segment URL path,
              trailing-slash normalization.
- verify.rs:  5 → 11 — empty manifest, zero-file patch (vacuous),
              extra package_paths ignored, multi-file short-circuit,
              Default/Clone/Eq impls.
- time.rs:    5 → 15 — non-leap Feb, year-end boundary, century
              non-leap (2100), 400-year leap (2000), every
              month-length transition, u64::MAX no-panic.
- mod.rs:     0 → 1 — re-export smoke test (compile-time guard).
- conformance_tests.rs (new): 17 cross-cutting tests pinning OpenVEX
              spec rules — @context literal, JSON-LD @-prefixed keys,
              status/justification interaction (action_statement
              reserved for status=affected; not_affected requires
              justification), required-field presence, non-empty
              identifiers, timestamp consistency, version=1,
              no-null invariant, alias/subcomponent uniqueness.

Remaining 5 uncovered regions documented in-source as unreachable in
practice (e.g. `civil_from_days` negative-`z` arm — requires inputs
past year ~292 billion).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>