test(vex): label cargo lock shapes in assert messages

CodeQL's default setup raised 14 new `rust/cleartext-logging` alerts
on this branch, all in `assert_attested`'s panic messages. The SARIF
code flows start at the `uuid` reads inside `cargo_tag::tag_version`'s
`format!` (CodeQL's name heuristics classify any `uid`/`uuid`-named
identifier as sensitive), pass through the test's `tagged_version(U)`
wrapper into the `copy`/`locked` strings of
`cargo_vendored_a_attests_in_every_lock_version`, and end in the `what`
label interpolated into every assertion message of the helper.

A Socket patch uuid is a public identifier, so the alerts are false
positives, but they gate the PR and no CodeQL config file exists to
exclude tests. Break the path where the value entered the messages: the
loop now labels its two cases `tagged` / `untagged` instead of
embedding the tagged version strings, and `assert_attested` documents
that `what` is a shape label so the next test does not reintroduce the
flow.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs

@@ -377,7 +377,9 @@ type Shape = dyn Fn(&Fx);
 
 /// Exactly one statement: `purl` fixed by `uuid`'s GHSA (CVE alias), with the
 /// provenance `marker`; exit 0; a `verified` event carrying the vuln; the
-/// manifest is never written.
+/// manifest is never written. `what` is a shape label, never a tagged
+/// version: CodeQL classifies every `uuid`-derived string as sensitive and
+/// flags it in panic messages (`rust/cleartext-logging`).
 fn assert_attested(fx: &Fx, run: &Run, purl: &str, uuid: &str, marker: &str, what: &str) {
     assert_eq!(run.code, Some(0), "{what}: {}", run.env);
     assert_eq!(run.env["status"], "success", "{what}: {}", run.env);
@@ -1178,20 +1180,20 @@ fn cargo_vendored_a_attests_in_every_lock_version() {
         write_cargo_vendored(&fx, U, CargoVendored::Inline, PATCHED_RS);
         // The tagged copy + tagged lock (v5), and the pre-tag shape: an
         // untagged copy with its untagged lock entry.
-        for (copy, locked) in [
-            (tagged_version(U), tagged_version(U)),
-            (CRATE_VERSION.to_string(), CRATE_VERSION.to_string()),
+        for (shape, at) in [
+            ("tagged", tagged_version(U)),
+            ("untagged", CRATE_VERSION.to_string()),
         ] {
-            fx.put(&copy_toml, copy_at(&copy));
-            fx.put("Cargo.lock", cargo_lock_at(version, &locked, ""));
+            fx.put(&copy_toml, copy_at(&at));
+            fx.put("Cargo.lock", cargo_lock_at(version, &at, ""));
             let run = fx.vex(&["--proxy-url", &api.uri()]);
             assert_attested(
                 &fx,
                 &run,
                 CARGO_PURL,
                 U,
                 "vendored",
-                &format!("lock v{version} at {locked}, copy at {copy}"),
+                &format!("lock v{version}, {shape} copy and lock entry"),
             );
             assert!(warning_codes(&run).is_empty(), "v{version}: {}", run.env);
         }