Parse every cli_parse_* suite through hermetic::try_parse: four suites carry a byte-identical EnvScrub, and list/remove/main parse with no scrub at all #1956

[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register comment.

Kind: refactor. Register ID: T56.

Problem

The ten tests/cli_parse_*.rs suites use four different ways to keep the developer's ambient SOCKET_* env out of a parse.

1. Byte-identical EnvScrub RAII + hand env list + #[serial]. EnvScrub is md5-identical in four files: cli_parse_get.rs L69-L94, cli_parse_repair.rs L71-L96, cli_parse_vendor.rs L81-L106 and cli_parse_vex.rs L82-L107. Each copy has its own hand SOCKET_ENV_VARS list (27/26/32/35 entries), and the lists have drifted on the local vars. Each also has its own "scrub covers every env var" self-test, three of them different (static contains-check in vendor L573, executed in vex L320, GLOBAL∪LOCAL in scan L688). The four files carry 91 #[serial] attributes between them.
2. cli_parse_scan.rs with_clean_env (L31-L74), another hand list (49 #[serial]).
3. cli_global_args.rs has its own save_and_clear_global_env/restore_global_env and its own unscrubbed try_parse.
4. No scrub at all: cli_parse_list.rs (L31-L35), cli_parse_remove.rs (L18-L22) and cli_parse_main.rs call Cli::try_parse_from directly.

Meanwhile the canonical helper already exists: common/hermetic.rs try_parse L204-L223 removes every SOCKET_* var once per process and needs no hand list or #[serial]. Only cli_parse_apply and cli_parse_rollback use it.

Executed on main @ cbbbdb9:

$ SOCKET_JSON=true cargo test -p socket-patch-cli --test cli_parse_remove
panicked at cli_parse_remove.rs:42 (defaults_with_purl_positional)
panicked at cli_parse_remove.rs:58 (positional_uuid_stored_in_identifier)
test result: FAILED. 17 passed; 2 failed

SOCKET_JSON=1 … --test cli_parse_list -- defaults_match_contract fails the same way at L50.

The hand Snap mirrors of GlobalArgs that these suites compare against have drifted too, though each claims to snapshot "every parsed field": get and repair lack maven_config and the three no_* fields. Proof: adding --no-trust-lockfile-config --no-npm-allow-remote-config --maven-config none to long_yes_sets_yes with an unchanged want still passes. vendor's Snap lacks 9 of 27 fields, and vex's lacks maven_config. cli_parse_scan's snap uses {:?} and so covers new fields automatically.

Proposed change

• Route every cli_parse_* parse helper through hermetic::try_parse. Delete the four EnvScrub structs, the hand SOCKET_ENV_VARS/SCAN_ENV_VARS lists, their scrub self-tests, with_clean_env, and the #[serial] attributes on tests that no longer mutate env. Tests that really set an env var (e.g. repair's SOCKET_DOWNLOAD_ONLY pair) keep #[serial].
• Replace the four hand Snap mirrors with one comparison: either #[derive(PartialEq)] on GlobalArgs and the per-command *Args in src/args.rs, or a shared common::global_snapshot(&GlobalArgs) built from {:?}. Then delete the ad-hoc no_vlt_install_cleanup_* tests that exist only because Snap lacks that field.
• This needs nothing from Derive the env-var scrub lists from clap's bindings; SOCKET_NO_SOCKET_YML is missing from LOCAL_ARG_ENV_VARS #1837. Once try_parse sweeps by prefix, the hand lists go away instead of being derived.

Size

tests/cli_parse_{get,repair,vendor,vex,scan,list,remove,main}.rs and cli_global_args.rs, possibly one derive in src/args.rs. About −450 / +40 lines.

Acceptance criteria

• SOCKET_JSON=true SOCKET_YES=true cargo test -p socket-patch-cli --test 'cli_parse_*' --test cli_global_args passes (fails today).
• No struct EnvScrub or hand SOCKET_ENV_VARS list remains under tests/.
• Adding an unrelated global flag to a get/repair/vendor/vex parse with an unchanged expectation fails the test.
• Parse behavior is unchanged: the remaining tests stay green.