test(e2e): expand sidecar coverage + simplify PTY harness

Five test surfaces, one bug fix, one YAGNI cleanup, one harness
simplification — all motivated by closing the e2e gap on the new
typed `Envelope.sidecars[]` contract.

  - **e2e_safety_advisories.rs** (new, 5 tests): drive the apply
    CLI against handcrafted layouts and assert
    `envelope.sidecars[].{ecosystem,advisory.code,advisory.severity,
    files[]}` for pypi (`pypi_record_stale`), gem
    (`gem_bundle_install_reverts`), golang (`go_mod_verify_fails`),
    nuget unsigned (deleted files only), and nuget signed (deleted
    files + `nuget_signed_package_tampered` advisory together —
    the case the pre-typed-contract design lost).

  - **e2e_safety_cow.rs** (new, 5 tests): cover `patch/cow.rs` end
    to end — hardlink isolation, symlink replacement, multi-file
    hardlink, regular-file no-op, and the failure-doesn't-cow path.
    Lifted file coverage from ~23% to ~80% (remaining gaps are
    defensive I/O error arms not reproducible in tests).

  - **e2e_safety_cargo_build.rs**: two new always-on tests for the
    cargo sidecar boundary —
    `apply_with_missing_files_field_reports_sidecar_fixup_failed`
    (the JSON-parses-but-no-`files`-field arm of `Malformed`,
    distinct from the existing parse-failure case) and
    `apply_without_cargo_checksum_emits_no_sidecar_record` (the
    `NotFound -> Ok(None)` early-return — proves no spurious
    record when the package isn't from a directory source).

  - **interactive_prompts_e2e.rs**: simplify the PTY harness.
    Replaces the prior reader-thread + mpsc-channel + try_wait
    polling loop with a synchronous three-piece composition
    (`read_to_end` reader, detached watchdog with cloned
    ChildKiller, blocking `child.wait()` on the main thread). No
    pre-write sleep — the PTY buffers input. All six prompt
    tests still pass with materially less harness code.

  - **common/mod.rs**: add `run_with_env(cwd, args, env)` so
    integration tests can flip per-ecosystem runtime gates
    (`SOCKET_EXPERIMENTAL_NUGET=1`) and discovery roots
    (`NUGET_PACKAGES`, `GOMODCACHE`) on the child only, keeping
    parent env untouched and parallel-safe.

  - **Bug fix**: `in_process_remote_ecosystems_apply.rs` and
    `in_process_rollback_all_ecosystems.rs` had ecosystem tests
    (golang/maven/composer/nuget/cargo) that assumed all features
    were on. Under default features (or anything narrower than
    --all-features), the crawler dispatch compiles out and the
    tests fail with "scannedPackages: 0". Gated each test on
    `#[cfg(feature = "<eco>")]` to match the build matrix. Quiet
    the resulting dead-code noise with a file-level allow.

  - **YAGNI**: drop `SidecarFileAction::Created`. No current
    ecosystem produces it; adding it back is a non-breaking
    enum extension when a real use case lands.

All ~456 workspace tests pass under `--all-features`.

Assisted-by: Claude Code:claude-opus-4-7

Author: mikolalysenko

crates/socket-patch-cli/tests/common/mod.rs

@@ -49,12 +49,24 @@ pub fn has_command(cmd: &str) -> bool {
 /// environment so apply paths default to the public proxy and tests
 /// don't accidentally exercise authed endpoints.
 pub fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    let out: Output = Command::new(binary())
-        .args(args)
-        .current_dir(cwd)
-        .env_remove("SOCKET_API_TOKEN")
-        .output()
-        .expect("failed to execute socket-patch binary");
+    run_with_env(cwd, args, &[])
+}
+
+/// `run` + child-only env-var injection. Useful for tests that need
+/// to flip the per-ecosystem runtime gates (`SOCKET_EXPERIMENTAL_NUGET`)
+/// or override discovery roots (`NUGET_PACKAGES`, `GOMODCACHE`) without
+/// touching the parent process's environment — keeps tests parallel-safe.
+pub fn run_with_env(
+    cwd: &Path,
+    args: &[&str],
+    env: &[(&str, &str)],
+) -> (i32, String, String) {
+    let mut cmd = Command::new(binary());
+    cmd.args(args).current_dir(cwd).env_remove("SOCKET_API_TOKEN");
+    for (k, v) in env {
+        cmd.env(k, v);
+    }
+    let out: Output = cmd.output().expect("failed to execute socket-patch binary");
     let code = out.status.code().unwrap_or(-1);
     let stdout = String::from_utf8_lossy(&out.stdout).to_string();
     let stderr = String::from_utf8_lossy(&out.stderr).to_string();