Keep the in-memory hosted engine off the disk for Go workspaces - #2031

Version-selection inertness in replaced_purl, and the hosted selection
checks, ran before Workspace::bypass. A Socket replace that the
governing go.work also refuses (not used, overridden by a go.work
replace, member conflict) was dropped as inert with a diagnostic
instead of being kept as a GoWorkspaceOverride ref, so list, rollback
and remove could not find wiring that re-running scan or vendor would
never clear. Compute the bypass first and skip the inertness checks for
a bypassed replace; it stays a ref and is reported unattested.

Found by Cursor Bugbot on #2011.

Co-Authored-By: Claude <noreply@anthropic.com>

This fixes the confirmed /code-review high findings on #2011. Each fix
has a test that fails on the previous commit.

- A Go workspace mark now applies to one file only. The new
  UnattestedKind::file_scoped is true only for GoWorkspaceOverride.
  vex_sources drops the bypassed ref from the candidate's basis and
  vetoes the patch only when no live ref of it remains. wiring_conflicts
  ignores bypassed refs. So a root go.work replace that go never reads no
  longer withholds the root go.mod's mirror of it. A leftover member pin
  that Socket's own go.work replace overrides no longer turns into a
  wiring conflict that also withholds the go.work patch, which is what
  vex.rs's WorkHosted exemption intends.
- A replace of a module that is itself a `use` member is diagnosed as
  inert again, both on disk and in memory, hosted and vendored. This
  check now runs before the workspace bypass.
- SumPins now also reads the sum files the loader already read: the
  governing go.work.sum and each out-of-root member's go.sum. They are
  used only when they lie inside the git repository.
- In memory, workspace conflicts are evaluated in
  go_workspace::PathSpace::Memory. Paths are compared lexically against
  the view's files and never against the filesystem or the working
  directory. conflict/work_conflict delegate to the new *_in variants,
  so disk behavior is unchanged.
- The snapshot probe list is now built by one shared helper
  (workspace_probes), spelled the way resolve_with spells it.
- A root go.work that go doesn't read is no longer judged unparseable,
  and its wiring stays an unattested ref.
- The go_workspace_override omission phrase now covers every case.
- read_loaded_workspace uses members_within. The view re-reads only the
  in-root members' go.mod, which recognition and parse diagnostics need.
  The duplicate go.sum and go.work.sum reads are gone.
- Tests that use a nested project now create a .git, so they keep
  working once reads are bounded to the repository root (#2025).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The hosted engine hands the golang rewriter the Go workspace it read
(HostedGoWorkspace). In memory its paths are root-relative, but the
rewriter still judged them with the disk checks: replace_host,
rooted_at, selection and host_conflict canonicalized against the
process's cwd and probed `<cwd>/go.mod`. So an in-memory project whose
root module go.work does not `use` got "nowhere to go" (no go.mod)
when the server's cwd had none, and the member answer when it did.

HostedGoWorkspace now carries `files`: in memory, the root-relative
files that exist (go.work, a readable root go.mod, each in-root
member's readable go.mod), filled by the engine as discovery lists
them. The rewriter routes every workspace check through
`PathSpace::Memory` when it is set, via new `_in` variants of
`replace_host`, `selection`, `host_conflict` and `conflict` on
GoWorkspace / Loaded. Disk behaviour is unchanged (the old names
delegate with `PathSpace::Disk`).

`GoWorkspace::selection` also displayed a main-module member through
the disk display_path; discovery's build-list graph now carries the
workspace's PathSpace so in-memory discovery uses `selection_in` too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2984629 dropped every workspace-bypassed ref from wiring_conflicts, so a
leftover member pin that Socket's go.work replace overrides would not
withhold the go.work patch. That also caught the root go.mod. A
GOWORK=off build from the root reads the root go.mod, so a different
patch there still disagrees with go.work about what the build links.
The behavior is the same reasoning ReplaceHost::mirrors_root_go_mod
uses. e2e_vex_lockfile golang_go_mod_and_go_work_disagreeing_attest_neither
went red in coverage (2): it got go_workspace_override plus
go_version_not_selected skips, not one wiring_conflict skip.

Count bypassed refs in the root go.mod as wiring again. Member go.mod
pins are still exempt, as a_bypassed_leftover_pin_is_no_wiring_conflict
requires.

Co-Authored-By: Claude <noreply@anthropic.com>

… fix/hosted-memory-go-pathspace

- GoWorkspace carries its own `files` (in memory: the root-relative
  files that exist; `None` on disk) and every method routes through
  `GoWorkspace::paths()`. The `_in(PathSpace, ..)` variants and their
  Disk-default wrappers are gone, so no caller can judge an in-memory
  workspace against the disk or the cwd. HostedGoWorkspace::files and
  its paths() go with them; the rewriter's code is back to the base's.
- One builder for the in-memory workspace, go_workspace::read_memory,
  over a MemoryFiles reader: the hosted engine reads through
  read_advisory, discovery through its guarded reads (diagnosing an
  unparseable member go.mod). Both list a file in `files` when it
  exists (a link, an entry without content, a go.mod go cannot parse
  all count), checked without reading it, and both drop an unparseable
  member go.mod's text.
- members_within no longer counts `../out` or an absolute member as
  inside the empty in-memory root (strip_prefix("") matched them), so
  the NoModule hint names in-root members only.
- PathSpace::from_files builds the space from an optional file list.
- The cwd test moved to hosted::engine's tests; read_go_workspace is
  private again. The redirect fixtures list the root go.mod whenever
  the project has one, as read_memory does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Second review round on Go workspace discovery.

- A Socket replace of a module that is itself a `use` member (every
  replace of it is inert, and the writers refuse it with
  `WorkspaceConflict::MainModule`, which a re-run never clears) was
  dropped with a diagnostic, so rollback, remove and list lost wiring
  still in the file. It stays a ref, marked `GoWorkspaceOverride`
  with the same "is inert" detail (owner decision 4).
- go.sum / member sums / go.work.sum were read only when a hosted ref
  existed, so a sum left by a reverted patch was no longer recognized
  and a dead ledger claim could be re-derived from its raw text
  (rule 11). They are recognized either way.
- The plan both attested a purl (the live go.work patch) and reported
  it skipped for a lockfile-only candidate whose only ref is a stale,
  bypassed leftover pin of another patch. That candidate is now dropped
  with a note when another candidate attests the purl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… fix/hosted-memory-go-pathspace

Second review round on the in-memory Go workspace.

The in-memory hosted engine dropped the text of a member go.mod go
cannot parse, while the disk loader keeps it: a member declaring the
patched module (every replace of it inert, `MainModule`) or replacing
it was refused on disk but pinned over in memory. `MemoryFiles::
unparseable` now says whether the text is kept: the engine keeps it,
discovery still drops it after its diagnostic.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>