test(manifest): resolve the JVM compat fixtures' deps from generated stub artifacts

The maven-compat smoke fixture declared commons-io, junit and hamcrest as real
artifacts from Maven Central purely to get a graph shape: an external prod dep,
a test-scope dep and its transitive. No fixture code imports them, so they were
never compiled against or executed - but they still aged into GHSA-78wr-2p64-hpwj,
a Dependabot alert, and a version bump.

gradle-compat already solved this: make-localrepo.sh generated a tiny file-based
Maven repo of empty-jar stubs at test time. That generator moves up a directory to
test/make-stub-repo.sh, gains the ability to give a stub its own dependency, and
now serves all three fixtures. maven-compat resolves demo.ext:tool (prod),
demo.ext:harness (test) and its transitive demo.ext:harness-core through a
<repository> whose URL smoke-test.sh passes as -Dstub.repo.url; sbt-compat
resolves demo.ext:tool and demo.ext:harness the same way.

The suites also stop using the developer's home caches. compat-cache.sh resolves
one cache root under the temp dir, overridable by SOCKET_COMPAT_CACHE, and each
tool is pointed at it: Maven by -Dmaven.repo.local, Gradle by -g, sbt by
-Dsbt.ivy.home and COURSIER_CACHE. The root is stable so each tool's own closure
is downloaded once, but the stub artifacts are evicted before every run, so a run
can never pass on a stale copy of the thing under test. Nothing is read from or
written to ~/.m2, ~/.gradle or ~/.ivy2, and records.tsv no longer embeds a path
under the developer's home.

Assertions prove exactly what they proved before, still matching on
groupId:artifactId with no version written in any test, and still keying on the
.jar suffix rather than any path. The transitive check is now unconditional: with
a stub graph it is deterministic, so its absence is a defect rather than a
junit-version detail.

Each build tool still fetches its own closure from Central - Maven's plugins pull
commons-io themselves - so this is not a fully offline fixture. It declares no
third-party dependency of its own.

Author: jdalton

.gitignore

@@ -294,13 +294,14 @@ pnpm-debug.log
 /packages/cli/src/commands/manifest/scripts/test/gradle-compat/project/.socket.facts.json
 /packages/cli/src/commands/manifest/scripts/test/gradle-compat/project/.gradle/
 /packages/cli/src/commands/manifest/scripts/test/gradle-compat/project/build/
-/packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/
 /packages/cli/src/commands/manifest/scripts/test/gradle-compat/.populate-for.txt
+/packages/cli/src/commands/manifest/scripts/test/maven-compat/project/localrepo/
 /packages/cli/src/commands/manifest/scripts/test/maven-compat/project/records.tsv
 /packages/cli/src/commands/manifest/scripts/test/maven-compat/project/target/
 /packages/cli/src/commands/manifest/scripts/test/maven-compat/project/*/target/
 /packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/target/
 /packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/project/target/
 /packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/project/build.properties
 /packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/scala-version.sbt
+/packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/localrepo/
 /packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/records.tsv

packages/cli/src/commands/manifest/scripts/test/README.md

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Shared cache root for the JVM compat suites: the downloaded build-tool distributions plus each
+# tool's dependency cache. Keeping the caches here rather than in ~/.m2, ~/.gradle and ~/.ivy2 means
+# a run can't pass off a warm home cache, can't write a home path into the records it emits, and
+# can't leave anything behind in the developer's own caches. Point SOCKET_COMPAT_CACHE at a fresh
+# `mktemp -d` for a cold run.
+SOCKET_COMPAT_CACHE="${SOCKET_COMPAT_CACHE:-${TMPDIR:-/tmp}/socket-manifest-compat}"
+mkdir -p "$SOCKET_COMPAT_CACHE"