Fix: Allow MVS-raised replace pins in golang discovery

In a workspace, MVS can select a version higher than any member's direct
require due to dependencies. Previously, replaced_purl rejected any replace
where v != r, even when the replace matched the MVS-selected version.

This fix only treats lower pins as definitively inert (stale pins after
upgrade), allowing higher pins through to be validated by the caller's
graph.select() check, which properly accounts for full MVS selection.

Author: cursoragent

crates/socket-patch-core/src/vex/discover/golang.rs

@@ -585,15 +585,21 @@ fn replaced_purl(
     };
     let version = match (entry.version.as_deref(), req) {
         (Some(v), Some(r)) if v != r => {
-            out.diag(
-                DIAG_REF_INVALID,
-                file,
-                format!(
-                    "{file}: replace {module} {v} is inert: {basis} {module} {r}, \
-                     so the build uses the unpatched module"
-                ),
-            );
-            return None;
+            // In a workspace, MVS can select a version higher than any
+            // member's direct require. Only treat lower pins as definitively
+            // inert; let the caller's graph.select() check handle higher ones.
+            if go_semver_cmp(v, r).is_lt() {
+                out.diag(
+                    DIAG_REF_INVALID,
+                    file,
+                    format!(
+                        "{file}: replace {module} {v} is inert: {basis} {module} {r}, \
+                         so the build uses the unpatched module"
+                    ),
+                );
+                return None;
+            }
+            v
         }
         (Some(v), _) => v,
         (None, Some(r)) if versioned.contains(&(module, r)) => {