refactor: remove obsolete vendoring machinery and duplicate crate code

[Mikola Lysenko (mikolalysenko)]

Vendoring still carried local-build fallback machinery after acquisition became service-only, including impossible result branches and unused inputs threaded through multiple backends. The crates also repeated archive validation, restore helpers, ledger initializers, and test setup.

Remove 2,133 net Rust lines across 73 files (1,410 added / 3,543 deleted). Public entry-point signatures, ledger serialization, refusal diagnostics, and artifact integrity checks are preserved.

• Replace custom service-result enums, aliases, and conversion wrappers with Result; remove unused local-build arguments, request fields, and impossible branches.
• Delete dormant archive-validation modes and the unused Gradle removal helper; exercise the real extractors in the retained malformed-archive and layout tests.
• Share ledger construction, fifteen vendoring fixture adapters, upstream restore helpers, staging cleanup, XML attribute parsing, and benchmark setup.
• Simplify CLI dispatch and preview logic, ecosystem matching, and Node serialization; remove stale fallback documentation. Consolidate four duplicate service-configuration tests into the retained stricter cases, preserving their assertions and independent safety oracles.

Validation against current main (a8e9397fe):

• 8,143 tests passed: 7,020 core/CLI unit tests, 1,030 CLI integration tests, 50 upstream restore golden tests, 29 benchmark tests, and 14 Node smoke tests against a rebuilt addon.
• CLI integration coverage includes get, vendoring, repair, rollback, and VEX/lockfile behavior.
• cargo check --locked --workspace --all-targets --all-features passed.
• CI lint command cargo clippy --locked --workspace --all-features -- -D warnings passed.
• Changed-file rustfmt checks and git diff --check passed.

CHANGELOG.md is untouched.

---

Note

Medium Risk
Vendoring no longer falls back to local builds when prebuilts are missing, which changes runtime behavior for --vendor-source=auto users; hosted get release narrowing moved earlier but should be equivalent.

Overview
Large cleanup that makes vendoring acquisition service-only and deletes duplicated helpers across the Rust workspace (~2k net lines removed).

Vendoring backends (cargo, composer, gem, golang, npm dir/tarball, maven, nuget, etc.) no longer thread local-install / patch-apply fallbacks: custom ServiceAttempt enums become Result, ServicePolicy drops auto vs service branching, and VendorServiceConfig::service_enabled() only checks offline + API client. Staging paths like stage_patch_dir and materialise_patched_copy require a verified prebuilt artifact or refuse.

Shared construction and restore plumbing: VendorEntry::new replaces hand-built ledger structs in production and tests; benchmark fixtures get one fixture() in mod.rs; upstream restore helpers (by_uuid, read_or_refuse, refuse_all_in) move to upstream/mod.rs; Ivy parsing reuses formats::xml::attr; cleanup_failed_stage is centralized in vendor/common.

CLI behavior tweaks: get runs filter_to_installed_releases once for hosted and agent dry-run previews (removing the duplicate hosted block); vendor dispatch simplifies ecosystem/service checks and nuget/maven source passing. Minor ecosystem parsing/display simplifications and removal of unused Gradle remove_apply_line.

^{Reviewed by Cursor Bugbot for commit 2b43a69. Configure here.}

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2b43a69. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: 2b43a694
• CI: every check green except main-wide failures that also fail on main at a8e9397: e2e (ubuntu-latest, e2e_safety_pnpm), hosted-e2e (withdrawn free minimist@1.2.2 patch, Merge queue blocked: production no longer publishes free minimist@1.2.2 patch #1293; fixes in Repin live minimist@1.2.2 suites to republished patch 642d7f02 (#1293) #1301/Follow the republished minimist canary patch #1302), and the ci-ok roll-up plus the vlt native (*) legs (also red on main).
• Bugbot: reviewed this head, no findings; no open review threads.
• No CHANGELOG.md changes.
• Re-ran the cancelled coverage-docker (maven) job; it passed. Large removal (73 files): worth checking nothing still referenced is deleted.

---

Generated by Claude Code