Read composer.json through the VEX discovery context

The source-install veto read composer.json directly, which the VEX
discovery rules forbid: every extractor reads through DiscoverCtx so
unreadable files are diagnosed and Socket identities are recognized.
Also add the golden entries for the dist-mirrors-before-url fixture.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-core/src/vex/discover/composer.rs

@@ -94,15 +94,13 @@ struct InstallPreference {
 }
 
 impl InstallPreference {
-    /// Read quietly: composer.json is not a lock, and a missing or
-    /// unparseable one leaves composer's default.
-    async fn load(ctx: &DiscoverCtx<'_>, lock: &Value) -> Self {
-        let preferred_install =
-            crate::utils::fs::read_regular_to_string(&ctx.root.join(COMPOSER_JSON))
-                .await
-                .ok()
-                .and_then(|text| serde_json::from_str::<Value>(&text).ok())
-                .and_then(|manifest| manifest.get("config")?.get("preferred-install").cloned());
+    /// A missing or unparseable composer.json leaves composer's default.
+    async fn load(ctx: &DiscoverCtx<'_>, lock: &Value, out: &mut Discovery) -> Self {
+        let preferred_install = ctx
+            .read_text(COMPOSER_JSON, out)
+            .await
+            .and_then(|text| serde_json::from_str::<Value>(&text).ok())
+            .and_then(|manifest| manifest.get("config")?.get("preferred-install").cloned());
         Self {
             preferred_install,
             plugin_api_version: lock
@@ -202,7 +200,7 @@ pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
         );
         return;
     }
-    let preference = InstallPreference::load(ctx, &doc).await;
+    let preference = InstallPreference::load(ctx, &doc, out).await;
     // The inventory's own walk: `packages` then `packages-dev` (a missing
     // or non-array section — composer writes `"packages-dev": []`, older /
     // hand-trimmed locks may omit it — is simply empty).

crates/socket-patch-core/tests/fixtures/vex-discover-golden/redirect-composer.json

@@ -126,6 +126,51 @@
     "elsewhere": [],
     "live_claims": []
   },
+  "redirect/composer/composer-lock/dist-mirrors-before-url/expected": {
+    "refs": [
+      {
+        "purl": "pkg:composer/monolog/monolog@2.0.0",
+        "uuid": "44444444-4444-4444-4444-444444444444",
+        "mode": "hosted",
+        "source_file": "composer.lock",
+        "artifact_rel": null,
+        "locked_integrity": "Sha1Hex(\"abcdef0123456789abcdef0123456789abcdef01\")",
+        "integrity_required": true,
+        "url": "https://patch.socket.dev/patch/composer/monolog/monolog/2.0.0/11111111-1111-1111-1111-111111111111/44444444-4444-4444-4444-444444444444/monolog-2.0.0.zip",
+        "lockfile_basis_ok": true
+      }
+    ],
+    "diagnostics": [],
+    "recognized": [
+      {
+        "uuid": "11111111-1111-1111-1111-111111111111",
+        "mode": "hosted",
+        "file": "composer.lock"
+      },
+      {
+        "uuid": "44444444-4444-4444-4444-444444444444",
+        "mode": "hosted",
+        "file": "composer.lock"
+      }
+    ],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": [
+      {
+        "mode": "hosted",
+        "uuid": "44444444-4444-4444-4444-444444444444",
+        "purl": "pkg:composer/monolog/monolog@2.0.0"
+      }
+    ]
+  },
+  "redirect/composer/composer-lock/dist-mirrors-before-url/input": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": []
+  },
   "redirect/composer/composer-lock/dist-mirrors/expected": {
     "refs": [
       {