feat(study-crates): test-file target + reward-hacking benchmark prompt - #101

Strengthen ~79 integration test files so genuinely broken production code
can no longer stay green. Across the suite:

- Replace disjoint "didn't crash" asserts (`code == 0 || code == 1`) with
  exact expected exit codes derived from the production return paths.
- Upgrade substring/`contains` marker checks to byte-for-byte content
  equality plus git-sha256 verification, with negative "wrong blob must
  not leak" checks.
- Capture previously-swallowed Results (`let _ = run(...)`,
  `let _: Value = ...`) and assert on them; add no-side-effect guards.
- Convert exit-code-only e2e checks to parsed-JSON exact counts/events and
  wiremock `received_requests`/`.expect(n)` to prove the real path ran.
- Replace vacuous checks (`is_string()`, `is_boolean()`, `unwrap_or(true)`,
  `|| "Summary"` escapes) with exact values and on-disk verification.
- Add non-skippable host round-trips to the setup matrices and a shared
  oracle self-test module (independent hashlib goldens cross-checked
  against the production hash).
- Repair real prior weaknesses: pypi `scannedPackages` parse-swallow +
  too-low threshold, deno `< 2`/`|| echo 0`, stale version literal.

Fix: the oracle self-tests were gated behind `#[cfg(test)]`, which is not
set for integration-test crates, so they never ran; ungated so they
execute in every binary that pulls in `common`.

Intentionally-RED guards (scan all-batches-failed reports success, apply
empty-manifest partial_failure, python env/ not scanned) are left failing
by design to guard known-unfixed bugs; no production code changed.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…d --ecosystems

Add `golang` to the default feature set alongside `cargo` (npm, PyPI, and
Ruby gems are unconditional), so a default build supports npm/PyPI/gem/Go/
Cargo. maven, nuget, composer, and deno stay opt-in.

Validate `--ecosystems`/`SOCKET_ECOSYSTEMS` tokens against the compiled
`Ecosystem::all()` set via a clap value-parser. Previously an unsupported
name (a typo, or an ecosystem whose feature wasn't compiled in) parsed
fine, was silently dropped by partition/crawl, and surfaced as "0 patches"
with no hint why. It now fails closed with a message listing the supported
ecosystems for this build.

Gate the maven/nuget docker_e2e and setup_matrix suites behind their
ecosystem feature in addition to the docker-e2e/setup-e2e umbrella, so the
still-unsupported ecosystems' integration tests are fully opt-in. Update
the e2e-docker CI job to compile each harness with its ecosystem feature
(npm/pypi/gem are unconditional and need only docker-e2e), so the gated
files don't compile to zero tests and pass vacuously.

Tests: make the --ecosystems parser tests feature-independent (use the
unconditional npm/pypi/gem) and add coverage for unsupported-name and
feature-off-maven rejection.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

`rollback_dispatch_branch_nuget` was failing the blocking `test`,
`test-release`, and `coverage` jobs: the nuget rollback crawler
discovers 0 packages, so the round-trip assertion fails. nuget and
maven are experimental ecosystems whose backends are unfinished, and
their e2e tests should not gate CI until we go back to implement them.

Mark the full experimental nuget/maven surface that runs in the blocking
`--all-features` jobs as `#[ignore]` (8 tests):
  - ecosystem_dispatch_e2e: {,rollback_}dispatch_branch_{maven,nuget}
  - e2e_nuget: scan_discovers_{global_cache,legacy}_packages
  - e2e_maven: scan_discovers_{maven_artifacts,gradle_project_artifacts}

They stay compiled and runnable on demand (`--features <eco> -- --ignored`)
and are still exercised by the non-blocking docker-e2e and setup-matrix
CI jobs.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ore]

Flags deno as experimental/unsupported, consistent with maven and nuget.

The setup-matrix `deno`/`mvn`/`dotnet` cases assert the aspirational
"install applies the patch" baseline, which is a known BASELINE GAP for
these experimental ecosystems (`setup` does not wire their install hooks
yet). They pass in CI today only because the hosted runners lack the
deno/mvn/dotnet toolchains, so the cases soft-skip — on any host that HAS
the toolchain (e.g. a dev machine with deno) the `test`/`test-release`/
`coverage` jobs fail (the deno case fails 2 of 6). That makes them latent
CI blockers for experimental ecosystems we don't want gating progress.

Mark the three aspirational matrix tests `#[ignore]`. The non-skippable
`host_guard` no-op-contract guards in each file stay active, the
docker-e2e + (non-blocking, continue-on-error) setup-matrix CI jobs still
exercise them, and they remain runnable via `--features setup-e2e[,<eco>] -- --ignored`.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>