scan's vendored planning and preview run the refusal preflights twice, and the planning copy skips the PyPI refusals #1908

[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register comment.

Kind: refactor. Register ID: T35.

Problem

scan/vendor_flow.rs asks "which selected purls would the wet run refuse?" through two separate functions. Each one loads the ledger and runs the whole preflight set on its own:

• preview_vendor L193-L270 runs load_state, then the Bun, vlt and npm-lock preflights, hosted_pnpm_refusals, the takeover refusals and pypi_refusals, and returns PreviewVerdict::WouldRefuse rows.
• preflight_refused_purls L349-L379 is the planning pass that keeps refused new patches from taking a --max-new-patches slot. It runs load_state, the Bun, vlt and npm-lock preflights, hosted_pnpm_refusals and gem_takeover_preview_refusals.

The two have drifted. The planning copy has no pypi_refusals (L205-L210 vs L370-L376).````` So a PyPI patch the backend refuses before downloading (pypi_no_requirements, `pypi_uv_no_sources`) still takes a rollout slot, while the preview of the same run shows it as `would_refuse`. That is my reading of the code; I have not executed it.

A dry run calls both functions back to back: scan/mod.rs calls the planning pass at L3306, then the preview at L3431 (the JSON path does the same at L772 and L790). So every preflight, the gem takeover probe and hosted_claimed_purls' lockfile discovery run two or three times.

All three callers of preview_vendor (scan/mod.rs L3425,`````` scan JSON L785 and get.rs L2287) also compute gem_takeover_preview_refusals and `patch_server_origins` themselves before passing them in.

Proposed change

• Keep one function: preview_vendor(common: &GlobalArgs, selected) -> VendorPreview, which computes origins and takeover refusals itself.
• The planning pass becomes preview.rows.iter().filter(|r| matches!(r.verdict, WouldRefuse{..})). Delete preflight_refused_purls.
• Compute the preview once per run and reuse it for planning and rendering.
• Assert the preview unit tests on PreviewVerdict and delete the test-only preview_vendor_json shape (L1409-L1443).

Size

scan/vendor_flow.rs, scan/mod.rs, get.rs. About −80 / +30 lines.

Acceptance criteria

• Refusal codes and preview rows are unchanged for Bun, vlt, npm-lock, pnpm and gem.
• A PyPI patch refused by pypi_refusals no longer takes a --max-new-patches slot. Add a unit test for this.
• The e2e_rollout* and vendored scan suites stay green.
• Overlaps T05/Run the Bun and vlt vendored preflights as one vendor_preflight with one per-purl refusal map #1839 (which merges the Bun and vlt preflights); either can land first.