Fix CI: coverage map and hermetic test spawns

docs/testing/vlt-coverage.json still listed the renamed vlt takeover
test under the reinstall-advisory variant. That test now asserts the
advisory is not emitted (the hosted pin stays), so drop it from that
list. lint-ecosystems failed on the stale name.

The two new takeover test files spawned the binary with a bare
Command::new, which the spawn_env_hygiene ratchet rejects. They now
use hermetic::binary_command().

Refs #853, #944

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/tests/in_process_vendor_pnpm_takeover.rs

@@ -16,11 +16,12 @@
 //! Every child process gets the ambient `SOCKET_*` vars scrubbed and
 //! telemetry hard-disabled; each test runs in its own tempdir.
 
+#[path = "common/hermetic.rs"]
+mod hermetic;
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
 use std::path::Path;
-use std::process::Command;
 
 use base64::Engine as _;
 use serde_json::{json, Value};
@@ -208,13 +209,8 @@ async fn mock_api(server: &MockServer) {
 /// Run the built binary with every ambient `SOCKET_*` var scrubbed and the
 /// npm registry pointed at the mock. Returns `(exit_code, envelope)`.
 fn run_json(cwd: &Path, registry: &str, args: &[&str]) -> (i32, Value) {
-    let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+    let mut cmd = hermetic::binary_command();
     cmd.current_dir(cwd);
-    for (key, _) in std::env::vars() {
-        if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(key);
-        }
-    }
     cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
         .env("SOCKET_NPM_REGISTRY", registry);
     let _fixture = prebuilt_common::prepare_command(&mut cmd, cwd, args, &[]);

crates/socket-patch-cli/tests/in_process_vendor_pypi_takeover.rs

@@ -14,12 +14,13 @@
 //! The patch API, the hosted wheel and PyPI's JSON API are wiremock; no
 //! Python toolchain is needed.
 
+#[path = "common/hermetic.rs"]
+mod hermetic;
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
 use std::io::Write as _;
 use std::path::Path;
-use std::process::Command;
 
 use base64::Engine as _;
 use serde_json::{json, Value};
@@ -279,7 +280,7 @@ fn run_scan(root: &Path, server: &MockServer, mode: &str, extra: &[&str]) -> (i3
     .unwrap();
     std::fs::write(info.join("RECORD"), "six.py,,\n").unwrap();
     let uri = server.uri();
-    let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+    let mut cmd = hermetic::binary_command();
     cmd.args([
         "scan",
         "--mode",
@@ -299,11 +300,6 @@ fn run_scan(root: &Path, server: &MockServer, mode: &str, extra: &[&str]) -> (i3
     .arg("--cwd")
     .arg(root)
     .current_dir(root);
-    for (key, _) in std::env::vars() {
-        if key.starts_with("SOCKET_") {
-            cmd.env_remove(key);
-        }
-    }
     cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
         .env("SOCKET_PYPI_JSON_API", format!("{uri}/pypi"))
         .env("VIRTUAL_ENV", &venv)

docs/testing/vlt-coverage.json

@@ -148,7 +148,6 @@
     ],
     "redirect_vlt_reinstall_required: hosted to vendored takeover": [
       "vlt_hosted_then_vendored_takeover_keeps_an_optional_hosted_copy",
-      "vlt_failed_vendor_after_the_takeover_revert_still_heals_the_store",
       "vlt_pinned_matrix_hosted_then_vendored_optional_takeover"
     ],
     "vendor_vlt_reinstall_required: optional dependency rewired or still linked upstream": [