Type the vendor reference status: four copies interpret PackageVendorResult.status strings and disagree on which answers are settled #1912

[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register comment.

Kind: refactor. Register ID: T39.

Problem

PackageVendorResult.status is a String, and four places each interpret its vocabulary (granted, reused, pending_build, build_failed, withdrawn, not_found, forbidden) on their own:

• core api/client.rs L1340-L1356 turns the status into a VendorServiceOutcome. Unknown statuses become Unavailable.
• core api/vendor_prefetch.rs L439-L443 reuses every answer except pending_build, so build_failed and unknown statuses are reused too.
• cli scan/withdrawn.rs L57-L59, L85-L91:`` is_gone matches `withdrawn` or `not_found`, and `KnownReferences::settled` keeps only `granted`, `reused`, `withdrawn`, `not_found` and `forbidden`. That drops `build_failed`, which prefetch keeps.
• cli scan/hosted.rs L2343-L2352 maps the same strings (plus pending) to human text.

The two reuse caches have different definitions of "settled": prefetch excludes only pending_build, while withdrawn uses an allow-list of five statuses. Each one documents its own rule.

Proposed change

• Add enum ReferenceStatus { Granted, Reused, PendingBuild, BuildFailed, Withdrawn, NotFound, Forbidden, Unknown(String) } in core api::types. Deserialize it from the string, keeping the wire format.
• Give it is_settled() and is_gone() methods.
• Make client.rs, prefetch, withdrawn and hosted all match on the enum, using one settled rule.
• Move KnownReferences beside the prefetch reuse cache in core.

Size

4 files plus api/types.rs. About −30 / +50 lines.

Acceptance criteria

• The wire format is unchanged.
• The skipped[].reason codes and texts are unchanged.
• vendor_prefetch and withdrawn tests pin the single settled rule. The rule has to decide whether build_failed is reused; prefetch's current behaviour is the default.
• only_withdrawn_and_not_found_are_gone becomes a test of ReferenceStatus::is_gone.