Fix the Maven <3.9.2 tamper probe and Windows snapshot keys (#973)

The host capstone's tamper probe re-resolved against a local repository
that step 3 had already warmed with the suffixed artifact, so Maven 3.6
and 3.8 served the cached copy and never re-read the checksumPolicy=fail
fallback repository. Drop the cached suffixed version first (a cold
re-resolve, as the docker twin and the pre-#973 test do).

tree_snapshot keyed files by the OS path, so the planner unit test's
removal of .socket/vendor/state.json missed on Windows. Key it with '/'.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/tests/e2e_vendor_maven_build.rs

@@ -405,7 +405,15 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
     // `maven.repo.local.tail` tree, a local repository Maven does not
     // checksum, so the tampered jar is what builds; there the gate is the
     // committed tree's review and VEX, which never attests it (below).
+    // A COLD re-resolve: step 3 cached the suffixed artifact in the local
+    // repository, which Maven serves without re-reading (or re-checksumming)
+    // any remote, so the cached copy is dropped first. Central's pristine
+    // 1.10.0 stays warm (it cannot shadow the suffixed version).
     std::fs::write(&sidecar, &good_sidecar).unwrap();
+    let cached = repo_dir(&m2, SV);
+    if cached.exists() {
+        std::fs::remove_dir_all(&cached).unwrap();
+    }
     let out = mvn.copy_dependencies(&fresh, &m2, &settings, "target/tamper");
     if mvn.numeric() >= vec![3, 9, 2] {
         assert!(ok(&out), "{}", dump(&out));

crates/socket-patch-core/src/vendor/test_support.rs

@@ -458,8 +458,12 @@ pub(crate) fn tree_snapshot(root: &Path) -> std::collections::BTreeMap<String, V
             if p.is_dir() {
                 walk(base, &p, out);
             } else {
+                // `/`-separated keys on every OS, so a caller can name one.
                 out.insert(
-                    p.strip_prefix(base).unwrap().to_string_lossy().into_owned(),
+                    p.strip_prefix(base)
+                        .unwrap()
+                        .to_string_lossy()
+                        .replace('\\', "/"),
                     std::fs::read(&p).unwrap(),
                 );
             }