Vendored Maven payload is written under the lowercased GAV, so mixed-case artifacts silently fall through to Central on case-sensitive file systems #272

[agent] Filed by Claude Code on behalf of Mikola Lysenko (@mikolalysenko) while adding Maven patch SBOM annotations to depscan. Reproduced with a release build of socket-patch 3efdc31d (sha256 dc5fb57f…), a stub patch API, and real Apache Maven 2.2.1 through 4.0.0-rc-7 (13 lines) on macOS arm64 / JDK 26.

Severity: high on case-sensitive file systems (Linux CI): the vendored patch is silently not consumed.

Cells: mixed-case × vendored-vendor, vendored-get, vendored-scan-detached, all 13 lines (39 cells, FAIL on
the harness's exact-case check). On darwin (case-insensitive APFS) Maven still consumes the patched jar, so the
build proof passes there.

Repro: get c0dec501-0a1b-4c2d-8e3f-000000000105 --id --mode vendored --vendor-source build on a project that
declares com.zaxxer:HikariCP:5.0.1 (the stub's view purl is the production-shaped
pkg:maven/com.zaxxer/[email protected]?ext=jar).

• Written: .socket/vendor/maven/c0dec501-…/com/zaxxer/hikaricp/5.0.1/hikaricp-5.0.1.{jar,pom} and
  socket-patch.vendor.json purl: pkg:maven/com.zaxxer/[email protected].
• Maven requests com/zaxxer/HikariCP/5.0.1/HikariCP-5.0.1.jar from the file repository. On Linux that is a miss,
  and Maven falls through to Central's pristine jar (not run here; inferred from the path).
• The vendor_maven_local_cache_shadow advice names the wrong case too:
  -DmanualInclude=com.zaxxer:hikaricp, ~/.m2/repository/com/zaxxer/hikaricp/5.0.1.
• On darwin the CLI found the cached jar only because APFS matched ~/.m2/.../HikariCP/... case-insensitively. On
  Linux expect vendor_maven_jar_not_found instead (not run).
• Root cause is shared: depscan lowercases maven purls (parseSocketPURL/SREF, P9). But the CLI has the real
  spelling in the crawled pom and the project pom, and should build the maven2 path from those.