Move LockfileEntry, LockIntegrity, SourceKind and http_url from vendor::lock_inventory into formats::entry #834

[agent] Filed by the scheduled architecture audit routine (ecosystems and formats). Register: discussion #560 register.

Kind: refactor (mechanical move). Source: review §2.1; 4.7 J. Register E20, step 1 of tracking #833.

Problem

The neutral "one lock-resolved package" types live in the vendored lock inventory:

• LockIntegrity, SourceKind, LockfileEntry and LockfileEntry::npm (lock_inventory/mod.rs#L108-L192);``
• http_url (#L394-L400).``

So every format reader that emits entries imports vendor:

• formats/gem/mod.rs#L28;
• formats/composer/mod.rs#L22;
• formats/pnpm/mod.rs#L39;
• formats/cargo/mod.rs#L35.

vex::discover (10 files), api/vendor_prefetch.rs, vendor/registry_fetch.rs and vendor/service_fetch.rs reach into vendor::lock_inventory for the same types. About 48 files name them, and the CLI has 9 references.

Symptoms

None. This is the formats → vendor cycle from Part 4.5 #2. Impact: low risk; it unblocks the codec moves in #833.

Proposed change

• Create crates/socket-patch-core/src/formats/entry.rs holding the four items verbatim (doc comments included), and pub use them from formats.
• Update the importers to crate::formats::entry::… (or formats::{LockfileEntry, …}). Keep pub use crate::formats::entry::{…} in vendor::lock_inventory only if the CLI's public paths need it; otherwise delete the old definitions outright.
• No behavior change. The UnsupportedNpmLayout diagnosis stays in lock_inventory (it is a discovery outcome, not an entry).

Size and scope

~90 moved lines plus roughly 50 one-line use edits. Out of scope: moving the codecs (#833 steps 2–4) and the redirect types (step 5).

Acceptance criteria

• grep -rn 'crate::vendor' crates/socket-patch-core/src/formats/{gem,pnpm,cargo,composer}/mod.rs no longer lists lock_inventory.
• The lock_inventory architecture_tests and formats::architecture_tests::format_models_are_pure stay green.
• cargo test -p socket-patch-core and -p socket-patch-cli give the same results as on main, and cargo clippy --all-targets is clean.

Dependencies

None. It conflicts mechanically with open PRs that edit use lines in vex/discover/* or lock_inventory/mod.rs (for example #750, #801); rebase onto whichever lands first. It is the first child of #833.

Backlog review — 2026-10-08

Consolidated into #833. The retained tracker(s) preserve this issue’s implementation scope and acceptance criteria. Closing this separate scheduling item as not planned, not as completed.

Explicit first child of the formats/neutral-types tracker; keep it as a checklist step in that tracker.