Move the v5 JVM vendor orchestration and Maven acquisition out of maven_repo.rs into vendor/jvm #972

[agent] Filed by the scheduled architecture audit routine (ecosystems and formats). Register: discussion #560 register.

Kind: refactor (mechanical move). Source: review Part 5.7; register E26. Child 1 of #971.

Problem

vendor/maven_repo.rs is named for, and documented as, the legacy single-pom backend. Its production half (L1–L2204 on 9c43dfc) also holds the whole v5 JVM orchestrator and the Maven download layer:

• jvm_shape, legacy_mixed_root, not_build_root, LocalSources;
• jvm_committed_patch, vendor_maven_jvm;``
• classifier, upstream verification and Gradle metadata acquisition;``
• materialisation, acquire_upstream_pom, fetch_registry_bytes, write_maven_artifact, sidecars,`` plus maven_registry_base / `MAVEN_USER_AGENT` (L50-L80).

About 1,170 of the ~2,200 production lines are JVM code. As a result:

• redownload.rs reaches into maven_repo::{not_build_root, acquire_jvm_metadata, acquire_jvm_artifact, write_maven_artifact, LocalSources};
• agent-mode patch/jvm_jar.rs imports vendor::maven_repo::{maven_registry_base, fetch_registry_bytes};
• vex/discover/maven.rs imports sha1_sidecar_matches.

No reader can tell which half a change touches, and retiring the legacy backend (#971) can't be a file deletion.

Proposed change

A move only, with no behavior change:

• vendor/jvm/vendor.rs gets the orchestrator: jvm_shape, legacy_mixed_root, not_build_root, LocalSources, jvm_committed_patch, vendor_maven_jvm, acquire_classifier, verify_unpatched_jar_members, verify_jvm_upstream, collect_*.
• vendor/jvm/fetch.rs gets the Maven download layer both backends use: maven_registry_base, MAVEN_USER_AGENT, MAX_POM_BYTES, fetch_registry_bytes, fetch_pom_bytes, acquire_upstream_pom, acquire_jvm_artifact, acquire_jvm_metadata, materialise_and_write, write_maven_artifact, artifact_in_sync, sidecar_matches, sha1_sidecar_matches.
• maven_repo.rs keeps the vendor_maven router, the legacy single-pom forward path, maven_entry, revert_maven_opts and the pom <repository> editing.
• Callers (redownload.rs, patch/jvm_jar.rs, vex/discover/maven.rs, test_support.rs) import from the new paths. Leave no re-export shims.
• Move each function's inline tests with it.

Size and scope

• About 1,200 production lines moved, with ~0 net change.
• Out of scope:
  • any routing or behavior change (Tracking: vendor every Maven shape through the jvm planner and retire the legacy single-pom backend #971 children 2–3);
  • the local sha1_hex copy (Compute sha256, sha1 and sha512-SRI digests through utils::digest instead of inline copies #706);
  • timeouts in fetch_registry_bytes (Registry downloads give up after 60 s even while the body is still arriving #872 / Bound registry downloads by ApiTimeouts instead of a 60 s total deadline (#872) #876).

Acceptance criteria

• git diff --stat shows a move: no logic edits beyond paths and visibility (pub(super) → pub(crate) where a sibling module now needs it).
• maven_repo.rs production code holds no super::jvm:: call except the router's dispatch and revert_maven_opts' is_jvm_entry arm.
• cargo test -p socket-patch-core vendor:: and the Maven/Gradle CLI e2e suites (e2e_vendor_maven*, e2e_vendor_gradle*) stay green unchanged.
• cargo clippy --workspace --all-features -- -D warnings is clean.

Dependencies

Land after #876, which edits fetch_registry_bytes in this file. Unblocks #971 children 3–4.