Spawn sbt and scala-cli test CLIs through the hermetic builder

spawn_env_hygiene's no_new_bare_binary_spawns ratchet failed on test,
test-release and coverage. The four sbt / scala-cli suites added on this
branch started the CLI with a bare Command::new(CARGO_BIN_EXE) and their
own SOCKET_* sweep. The sweep also removed the SOCKET_NO_CONFIG and
SOCKET_NO_UPDATE_CHECK guards that hermetic::command forces. Spawn them
through hermetic::binary_command() instead, and keep only the
COURSIER_* sweep these suites need on top of it.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

crates/socket-patch-cli/tests/e2e_sbt_vendor.rs

@@ -14,6 +14,8 @@
 //! drift, `repair`, a forged ledger, an escaping symlink, the subproject
 //! and build-edit refusals.
 
+#[path = "common/hermetic.rs"]
+mod hermetic;
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 #[path = "sbt_common/mod.rs"]
@@ -22,7 +24,6 @@ mod sbt_common;
 use std::collections::BTreeMap;
 use std::io::Write as _;
 use std::path::{Path, PathBuf};
-use std::process::Command;
 
 use sbt_common::{copy_evidence, record_pinned_resolution, write_coursier_artifact, Gav, SbtHome};
 use socket_patch_core::formats::sbt::owned_file::{
@@ -169,10 +170,10 @@ impl Fixture {
 
     /// `socket-patch <args> --json --cwd <proj>/<dir>`; `(exit, envelope)`.
     fn run_in(&self, dir: &str, args: &[&str]) -> (Option<i32>, serde_json::Value) {
-        let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+        let mut cmd = hermetic::binary_command();
         for (k, _) in std::env::vars_os() {
             let k = k.to_string_lossy();
-            if k.starts_with("SOCKET_") || k.starts_with("COURSIER_") {
+            if k.starts_with("COURSIER_") {
                 cmd.env_remove(&*k);
             }
         }

crates/socket-patch-cli/tests/e2e_sbt_vendor_build.rs

@@ -31,6 +31,8 @@
 //! VERSION,REQUIRED,SEED}` (`sbt_vendor_build_common`). Scratch trees go
 //! under `TMPDIR`.
 
+#[path = "common/hermetic.rs"]
+mod hermetic;
 #[path = "maven_build_common/mod.rs"]
 mod maven_build_common;
 #[path = "prebuilt_common/mod.rs"]
@@ -186,10 +188,10 @@ fn setup(
 impl Ctx {
     /// `socket-patch <args> --json --offline --cwd <dir>`; `(exit, envelope)`.
     fn socket(&self, dir: &Path, args: &[&str]) -> (Option<i32>, serde_json::Value) {
-        let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+        let mut cmd = hermetic::binary_command();
         for (k, _) in std::env::vars_os() {
             let k = k.to_string_lossy().into_owned();
-            if k.starts_with("SOCKET_") || k.starts_with("COURSIER_") {
+            if k.starts_with("COURSIER_") {
                 cmd.env_remove(&k);
             }
         }

crates/socket-patch-cli/tests/e2e_scala_cli_vendor.rs

@@ -27,6 +27,8 @@
 
 #![cfg_attr(windows, allow(dead_code, unused_imports))]
 
+#[path = "common/hermetic.rs"]
+mod hermetic_spawn;
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
@@ -214,10 +216,10 @@ fn socket_in_cache(
     args: &[&str],
     cache: &Path,
 ) -> (Option<i32>, serde_json::Value) {
-    let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+    let mut cmd = hermetic_spawn::binary_command();
     for (k, _) in std::env::vars_os() {
         let k = k.to_string_lossy().into_owned();
-        if k.starts_with("SOCKET_") || k.starts_with("COURSIER_") {
+        if k.starts_with("COURSIER_") {
             cmd.env_remove(&k);
         }
     }

crates/socket-patch-cli/tests/e2e_vex_lockfile/main.rs

@@ -20,6 +20,8 @@
 //! (with the PDM/Hatch and Pipenv/pip helpers beside it); `common_selftest`
 //! tests those helpers themselves.
 
+#[path = "../common/hermetic.rs"]
+mod hermetic;
 #[path = "../prebuilt_common/mod.rs"]
 mod prebuilt_common;
 #[path = "../sbt_common/mod.rs"]

crates/socket-patch-cli/tests/e2e_vex_lockfile/sbt_vendored.rs

@@ -20,7 +20,6 @@
 //! | e | no ledger | nothing attested; the tree check still runs |
 
 use std::path::{Path, PathBuf};
-use std::process::Command;
 use std::time::{Duration, SystemTime};
 
 use serde_json::Value;
@@ -134,10 +133,10 @@ impl Fx {
 
     /// `socket-patch <args> --json --cwd <proj>` in the isolated home.
     fn run(&self, args: &[&str]) -> (Option<i32>, Value) {
-        let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+        let mut cmd = super::hermetic::binary_command();
         for (k, _) in std::env::vars_os() {
             let k = k.to_string_lossy();
-            if k.starts_with("SOCKET_") || k.starts_with("COURSIER_") {
+            if k.starts_with("COURSIER_") {
                 cmd.env_remove(&*k);
             }
         }