Fix version-less pin profile override detection

Add managed_version_can_move() to check if profiles or inheritors can
provide different managed versions for version-less dependencies.
This fixes the bug where a profile's dependencyManagement section or
property redefinition could put unpatched JARs on the classpath while
attestable_checked stayed silent.

The fix checks both:
- Profile property redefinitions that change managed version resolution
- Profile-specific dependencyManagement entries that differ from base
- Inheritor management that provides different versions

Author: cursoragent

crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs

@@ -1808,6 +1808,68 @@ impl Reactor {
             .flatten()
     }
 
+    /// Whether a profile or inheritor can provide a different managed
+    /// version for `g:a` than what `rel` reads from top-level management,
+    /// either through profile property redefinition or profile-specific
+    /// `<dependencyManagement>` entries.
+    fn managed_version_can_move(&self, rel: &str, g: &str, a: &str, base: &str) -> bool {
+        // If the base managed version uses properties, check if profiles
+        // or inheritors redefine them to produce a different version.
+        if base.contains("${") {
+            if self
+                .version_moved(rel, base, &|v: &str| v != base)
+                .is_some()
+            {
+                return true;
+            }
+        }
+
+        // Check if any profile or inheritor has management that provides
+        // a different version (profile management or inheritor management).
+        std::iter::once(rel)
+            .chain(self.inheritors(rel))
+            .any(|reader| {
+                self.chain(reader).any(|at| {
+                    let doc = &self.poms[at].doc;
+
+                    // Check profile management entries
+                    let profile_manages_differently = doc.declarations().into_iter().any(|dep| {
+                        !doc.is_top_level_managed(dep) && doc.is_main_jar(dep) && {
+                            let resolve = |v: &str| self.interpolate(reader, v, 0);
+                            doc.coordinate(dep, "groupId", &resolve).as_deref() == Some(g)
+                                && doc.coordinate(dep, "artifactId", &resolve).as_deref() == Some(a)
+                                && doc.coordinate(dep, "version", &resolve).as_deref() != Some(base)
+                        }
+                    });
+
+                    if profile_manages_differently {
+                        return true;
+                    }
+
+                    // For inheritors, check if their top-level management differs
+                    if reader != rel {
+                        let inheritor_manages_differently =
+                            doc.declarations().into_iter().any(|dep| {
+                                doc.is_top_level_managed(dep) && doc.is_main_jar(dep) && {
+                                    let resolve = |v: &str| self.interpolate(reader, v, 0);
+                                    doc.coordinate(dep, "groupId", &resolve).as_deref() == Some(g)
+                                        && doc.coordinate(dep, "artifactId", &resolve).as_deref()
+                                            == Some(a)
+                                        && doc.coordinate(dep, "version", &resolve).as_deref()
+                                            != Some(base)
+                                }
+                            });
+
+                        if inheritor_manages_differently {
+                            return true;
+                        }
+                    }
+
+                    false
+                })
+            })
+    }
+
     /// Whether every pom that reads `dep` of `rel` resolves its version
     /// to `sv`: `rel` and each pom inheriting it, with or without a
     /// profile on its chain active (see [`Self::version_moved`]).
@@ -2050,13 +2112,20 @@ impl Reactor {
                 // A version-less declaration reads its management: under a
                 // local root left unpinned (management conflicting or
                 // unresolved outside the checkout) that may be the base.
-                if !managed_section
-                    && self
-                        .managed_version(rel, patch.group_id, patch.artifact_id)
-                        .as_deref()
-                        != Some(sv)
-                {
-                    uncertain.insert(at);
+                if !managed_section {
+                    let managed = self.managed_version(rel, patch.group_id, patch.artifact_id);
+                    if managed.as_deref() != Some(sv)
+                        || managed.as_ref().is_some_and(|mv| {
+                            self.managed_version_can_move(
+                                rel,
+                                patch.group_id,
+                                patch.artifact_id,
+                                mv,
+                            )
+                        })
+                    {
+                        uncertain.insert(at);
+                    }
                 }
                 continue;
             };