--exclude-paths on socket manifest auto/gradle/kotlin/maven/scala/
dynamic-sbom-inference reused the flag description from the scan/reach
flag definitions verbatim, which talks about "the scan" and full
application reachability analysis. None of these commands scan or run
reachability analysis themselves, so the wording was confusing when
viewed via --help on any of them standalone.

Adds a manifest-scoped excludePathsFlag with wording specific to
manifest/facts generation and switches all six commands to it.

…ation

Different projects in a repo may need different JDKs for their build
tool. Adds a javaHome field to defaults.manifest.{gradle,maven,sbt} in
socket.json, configurable via the socket manifest setup wizard, and
threads it through to the actual build-tool invocation (overrides
JAVA_HOME for that spawn only, everything else about the environment is
left untouched).

Applies to socket manifest gradle/kotlin/maven/scala, socket manifest
auto, and socket manifest dynamic-sbom-inference. Scoped to the Socket
facts generation path only, not the legacy --pom conversion path. No
new CLI flag - socket.json/the setup wizard is the only configuration
surface for now.

socket manifest dynamic-sbom-inference previously read socket.json once
at the overall recursion root and applied that single config to every
discovered build root. It now resolves each build root's own nearest
socket.json (walking up from that root, bounded at the recursion root,
nearest wins - no merging), so different projects in the same repo can
carry their own settings instead of being forced onto one shared config.

Also adds $VAR/${VAR} expansion for javaHome, resolved against the CLI
process's own environment. A hardcoded absolute JDK path only works on
whoever's machine wrote it; referencing an env var each developer sets
themselves (e.g. $JAVA11_HOME) makes a shared socket.json portable
across machines. Fails closed with a clear message if the referenced
variable isn't set, rather than silently passing a broken path to the
build tool.

readSocketJsonCascade (renamed from readOrDefaultSocketJsonUpTo) now
merges defaults.manifest.<ecosystem> field-by-field across every
ancestor between a build root and the recursion root, nearest winning
per field, instead of one file replacing the root config wholesale. A
subproject can now override just javaHome while still inheriting the
root's excludeConfigs/bin/etc., rather than having to restate the whole
config. Ecosystems the override doesn't mention are left untouched.

Verified against the sandbox tree: a root socket.json setting
excludeConfigs plus a nested one setting only javaHome both applied
together for that build root.

dynamic-sbom-inference always generates Socket facts SBOMs, never
pom.xml. If a build root's cascaded socket.json sets facts: false
(the pom-mode opt-out other manifest commands honor), that's ignored
here rather than skipping the project or silently doing nothing -
but it's a real, deliberate setting the user made, so it's surfaced
as a warning rather than silently overridden.

dynamic-sbom-inference previously forced Socket facts generation over
an explicit defaults.manifest.<ecosystem>.facts: false (pom mode),
just warning about it. Reverted: facts: false now skips the project
again, same as before that change, since this command has no pom-mode
equivalent to fall back to.

Also adds a separate ignored: true field (gradle/maven/sbt) scoped
specifically to dynamic-sbom-inference, for projects that should be
skipped during recursive generation regardless of their facts/pom
preference for other commands. Kept as its own boolean rather than
folding into facts, since facts already means something specific to
other manifest commands and overloading it would require touching
every consumer for a value only this command understands.

New skippedIgnored outcome status covers both reasons, distinguished
via the warning message.

A cascaded (not just root-level) disabled: true produces identical
per-root behavior to the ignored field just added, so keeping both
was redundant. Removed ignored; disabled now does double duty:
root-only ecosystem-wide gating for auto/gradle/etc. (unchanged), plus
a cascaded per-build-root skip specifically for dynamic-sbom-inference.

Renamed the skippedIgnored outcome status to skippedDisabled to match.

…ursive setup for dynamic-sbom-inference

- socket.json manifest fields now accept `null` as an explicit "clear the
  inherited value" sentinel, distinct from leaving a field unset; the setup
  wizard writes it when a previously-set value is cleared instead of just
  deleting the key.
- Add a lightweight per-ecosystem workspace enumeration path for
  gradle/sbt/maven (new standalone scripts, kept fully separate from the
  existing facts-generation scripts) that discovers a build's subprojects
  without running dependency resolution.
- Add a hidden `socket manifest setup --dynamic-sbom-inference` mode:
  configures root-level defaults per ecosystem, then recursively marks
  `disabled: true` on build roots matching `--exclude-paths`, leaving
  everything else untouched.
- Speed up `dynamic-sbom-inference`'s handling of a disabled build root with
  many nested candidates by reusing the nearest already-resolved disabled
  ancestor instead of re-walking the whole config cascade for each one, and
  only logging the root cause instead of once per nested candidate.

Previously each excluded build root got its own disabled:true write,
relying on cascade to skip descendants already covered by an ancestor
write. That only worked when the excluded ancestor happened to be a
build root itself; a non-project directory containing multiple sibling
projects would leave later siblings enabled.

Instead, group excluded projects by the shallowest directory that
actually matches --exclude-paths and write disabled:true there once,
covering every ecosystem and sibling/nested project beneath it
regardless of whether that directory is a build root of its own.

… is unknown

A build root whose facts generation fails (a build-tool crash or a
blocking resolution failure) never produces its projects[] list, so
there's no way to tell whether a later candidate underneath it is
already covered by that root or a genuinely independent project.
Continuing to process further candidates in that state risked
misclassifying subprojects and piling on doomed attempts against a
build already known to be broken.

Fail closed instead: abort the entire recursive walk as soon as one
build root's workspace layout can't be determined, rather than
continuing to sibling and nested candidates.

The recursive wizard (`socket manifest setup --dynamic-sbom-inference`)
previously only ever disabled build roots matching --exclude-paths;
every other discovered root was left completely untouched, with no
way to set its bin/JDK/opts short of running the plain single-project
wizard on it directly. Every non-excluded candidate now gets an
interactive configure-or-inherit-defaults prompt (in discovery order,
parent before child), seeded with its cascaded effective value so
accepting every prompt unchanged preserves whatever it already
inherits. Disabling a specific candidate is intentionally not offered
here - that stays --exclude-paths' job, so a whole excluded subtree
still collapses into a single write.

Also fixes a real bug surfaced along the way: askForBin pre-filled the
hardcoded tool fallback (mvn/./gradlew/sbt) as the prompt's shown
value, so accepting the default was indistinguishable from explicitly
typing it and got written to socket.json for no reason. The shown
default is now only ever a prior explicit value; the fallback is
mentioned as a hint instead. A matching guard drops any ecosystem
section that ends up empty so it doesn't count as configured or
trigger a write.

Finally, the root step now detects which ecosystems are actually
present at cwd (reusing the same check the plain wizard uses) and
asks about detected ecosystems first, phrased accordingly, before
offering to configure undetected ones "anyway" for subprojects that
might need them.

Fixes two correctness bugs found in an audit pass: leaving a config prompt
blank when the field was already explicitly cleared (null) deleted the key
instead of preserving the clear, silently reverting it to inheriting an
ancestor's value; and --exclude-paths never reached the wizard's workspace
enumeration, so excluding a broken reactor member didn't stop the wizard
from still trying to resolve it and aborting the whole walk.

Also tightens several UX rough edges in the recursive wizard: drops a
redundant write confirmation inconsistent with the rest of the flow, fixes
a tally line that double-counted re-enabled candidates and never reported
disabled ones, and softens wording that overclaimed knowledge the wizard
doesn't actually have yet (a build root at cwd, a fixed --exclude-paths
prompt count). Trims the surrounding comments down to non-obvious rationale
only, per repo comment-style guidelines.

Cuts several multi-line comment blocks down to their non-obvious why,
matching the repo's comment-style guidelines.

…cket-manifest-dynamic-sbom-inference-for-recursive

The merge brought package.json's version from 1.1.150-prerelease to a
clean release version, so these inline snapshots no longer matched.

1.1.152 never actually published (still 404s on the registry, staged
dist-tag is still 1.1.151), so bump to the next-version-hint convention
used elsewhere in this repo's release history and refresh the CLI banner
snapshots to match.

Drop reactor-member "skippedCovered" lines from the per-line table -
they're implied by their parent's line already showing up, and the
aggregate count in the summary still reports them. Also drop the
"across N build root(s)" total from the summary line: it counted every
candidate directory visited, including reactor members that aren't
independent build roots, which overstated how many actually exist.

Drop failed/skipped/empty from the tally: a failure aborts the whole
walk immediately rather than accumulating (and is already reported via
its own fail message), and the disabled/covered/empty buckets count
candidate directories rather than independent build roots, so a total
there is just as misleading as the "N build root(s)" figure already
removed.

Root cause of the flaky snapshot mismatches on this PR: whether the CLI
itself redacts its version banner (VITEST baked in at build time) or
prints the real one and leaves redaction to this test helper depends on
env propagation into the build step, not just the test run - so the same
source can produce either "<redacted>" or the real "vX.Y.Z-prerelease"
depending on how it was built. normalizeBanner's regex only stripped a
bare "vX.Y.Z", leaving a trailing prerelease suffix dangling in one case
but not the other. Broadened it to match a trailing prerelease/build
suffix and to be idempotent on an already-redacted value, so both cases
normalize identically. Refreshed the now-correct snapshots.

- Hide `socket manifest dynamic-sbom-inference` - its name collides with
  the unrelated, root-only --dynamic-sbom-inference flag on scan
  create/reach (different semantics: this one is recursive per-root).
  Keep it internal until that naming collision is resolved.
- --json --verbose emitted invalid JSON: the verbose debug preamble and
  run-manifest-facts' verbose resolution-detail logging both wrote to
  stdout ahead of the JSON payload. This is the only manifest command
  with --json, so the combination was newly reachable. Gated the
  preamble on !json and switched the detail logging to stderr.
- Fixed two stale "socket manifest setup --recursive" comments left over
  from an earlier flag name.
- renderTable no longer prints a bare blank line when there are no
  non-covered outcomes to show.

…the cascade

Every field shown to the sub-wizard (including ones inherited from an
ancestor, never touched by the user) was written verbatim into the
candidate's own file, permanently pinning that value against future
changes to the ancestor - converting inheritance into a one-time
snapshot despite the field-level cascade being the point. Now diffs the
final seed against an ancestor-only baseline (the cascade computed from
dir's parent, excluding dir's own file) and only writes fields that
actually differ, so an untouched field keeps inheriting live.

socket-workspaces.init.gradle, socket-workspaces.plugin.scala, and
CoanaWorkspacesLifecycleParticipant/SocketWorkspacesRecordsEngine had no
automated coverage at all - the local compat matrix only exercised the
facts scripts, so a registration or compile error in the workspaces
siblings would surface only as silent degradation (the setup wizard's
reactor-coverage pruning treating a real reactor as if it had no
members). Adds a smoke-test-workspaces.sh per ecosystem, wired into the
same per-version matrix run-compat.sh already runs for the facts
scripts, asserting each variant emits exactly a meta record plus the
expected project record(s) and nothing else (no node/root/file records,
confirming no dependency resolution happens). Verified locally against
the currently installed gradle/maven/sbt.

Only the first missing variable was ever reported, so a value
referencing two unset vars needed two runs to discover both. Also had
no way to represent a literal $WORD - $$ now expands to a literal $, so
whatever follows it is left untouched. Added a dedicated test file;
this function had none.