CI: share test helpers in the last 4 modules (#824)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #824

Summary

This is the last slice of #824. Four shared test modules still had their
own git_sha256, and vex_e2e_common also had its own binary(). They
couldn't use common because not every test target that includes them
also declares mod common:

module	private copy
vex_e2e_common/mod.rs	binary(), plus a git_sha256 that called production's hasher, so any check in those suites that compared the two was circular
vlt_e2e_common/mod.rs	git_sha256
vlt_hosted_common/mod.rs	git_sha256
vlt_vendor_common/mod.rs	git_sha256

Change

• binary() and git_sha256 move into a new tests/common/oracle.rs.
  common/mod.rs re-exports them, so the existing oracle_selftests still
  pin the hash to the Git-blob golden values and to production's hasher.
• vex_e2e_common, vlt_hosted_common and vlt_vendor_common pull in
  oracle.rs on its own with #[path] and re-export it. common/hermetic.rs
  and common/cache_env.rs are already shared this way. vlt_e2e_common
  already includes common, so it re-exports common::git_sha256.
• PENDING_PRIVATE_HELPERS is deleted from cli/shared_helper_copies.rs, so
  the ratchet now covers every test file outside common/.
• common/mod.rs loses its stale "migrate in a follow-up" doc.

CI cost

This is a test-only change with no workflow edits. A lean PR run keeps the
same job count (~28 Linux jobs) and job-minutes (~8 min wall).

Test evidence

Run locally (as root, Rust 1.93.1):

• cargo fmt --all -- --check: clean
• RUSTFLAGS="-D warnings" cargo check --locked --workspace --all-targets --all-features
  (the CI test-target gate): clean
• cargo test -p socket-patch-cli --all-features for these targets:
  • cli 110/110
  • e2e_vex_lockfile 345/345 (uses vex_e2e_common::git_sha256)
  • e2e_vlt 27 pass, 9 ignored
  • in_process_vendor 132/132 (uses vlt_vendor_common)
  • rollback 57/57 and apply 132 pass, 1 ignored (use vlt_hosted_common)
  • get 86/86 and spawn_env_hygiene 14/14
  • in_process_redirect: 139 pass, 3 fail. All three
    (partial_lockfile_write_failure_exits_1_and_writes_no_ledger,
    redirect_json_mode_write_failures_emit_error_envelope,
    vlt::scan_redirect_vlt_heal_invalidation_failure_warns) make a
    directory read-only with chmod 0o555 and expect the write to fail,
    which can't happen when running as root. They don't involve the
    helpers changed here.
• Red→green for the ratchet: appending a private pub fn git_sha256(..) to
  vlt_vendor_common/mod.rs turns
  cli::shared_helper_copies::no_new_private_binary_or_git_sha256 red
  (["vlt_vendor_common/mod.rs"]). Without it the test is green. Before this
  PR, that file was exempt.

Per-issue checklist:

• Tracking: share CLI test helpers through one test-support module instead of 100+ per-file copies #824: no test file outside common/ defines binary() /
  git_sha256. no_new_private_binary_or_git_sha256 enforces this with no
  allow-list.

/code-review high

I fixed one finding (the stale common/mod.rs doc). I didn't change code
for three others:

• The ratchet misses pub use <production hasher> as git_sha256. That
  shape doesn't exist in the tree, and covering re-export aliases would need
  a parser-level check for a hypothetical case.
• oracle_selftests stay in common/mod.rs, not oracle.rs. There is
  one source file, and dozens of targets that include common pin it every
  CI run. Moving the tests would compile and run them in every target again.
• vlt_e2e_common re-exports common::git_sha256 instead of including
  oracle.rs. It already compiles common, so another #[path] include
  would add a second copy of the same file to that target.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Hiv3kKKJLF4NHLhReP3vim

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code