docs(cli): align v5 help with lockfile-first patching

[Mikola Lysenko (mikolalysenko)]

Make root and scan help describe discovery from project dependency files, including fresh checkouts, hosted writes by default, and --dry-run previews. Keep installation and resolution prerequisites explicit for agent mode and affected ecosystems. Show repair as an agent and vendored artifact command, including the requirement to restore a lost vendor ledger from version control.

Align the README and usage guide, and document the v5 service-only vendoring break: build is rejected through both CLI and environment configuration, auto aliases service, unavailable artifacts never fall back to local builds, and offline reuse of healthy committed artifacts differs from fetching new ones. No command names, defaults, or behavior change.

Closes #1289.

Validation:

• cargo test --locked -p socket-patch-cli --test help_text_hygiene --test cli_parse_scan --test cli_parse_repair --test cli_parse_vendor — 109 tests passed.
• cargo fmt -p socket-patch-cli -- --check and git diff --check passed.
• Inspected rendered root, scan, and repair help with both -h and --help.

The full workspace formatting check reports an existing formatting difference in crates/socket-patch-core/src/patch/redirect/upstream/mod.rs:917; that file is identical to the base and unchanged by this PR.

---

Note

Low Risk
Documentation and help-text only; behavior and CLI defaults are unchanged per the PR description.

Overview
Updates user-facing docs and CLI help so v5 reads as lockfile-first hosted patching: scan is described as discovering patches from dependency files (including fresh checkouts), with explicit caveats for agent mode and ecosystems like sbt/scala-cli.

repair is reframed in root help, README, usage, and migration docs as restoring both agent and vendored artifacts, including that a lost .socket/vendor/state.json must come from version control—not rebuilt from lockfiles.

Documentation now spells out service-only vendoring: --vendor-source build / SOCKET_VENDOR_SOURCE=build are usage errors, auto aliases service with no local build fallback, while committed healthy artifacts can still install offline.

Help hygiene tests are updated to match the new strings; no runtime behavior or CLI defaults change in this PR.

^{Reviewed by Cursor Bugbot for commit be0f04d. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: be0f04d2
• CI: every check green except main-wide failures that also fail on main at a8e9397: e2e (ubuntu-latest, e2e_safety_pnpm) and hosted-e2e (withdrawn free minimist@1.2.2 patch, Merge queue blocked: production no longer publishes free minimist@1.2.2 patch #1293; fixes in Repin live minimist@1.2.2 suites to republished patch 642d7f02 (#1293) #1301/Follow the republished minimist canary patch #1302), plus the ci-ok roll-up.
• Bugbot: reviewed this head, no findings; no open review threads.
• No CHANGELOG.md changes.
• Docs/help-text only; reviewer should check the help strings against current behavior.

---

Generated by Claude Code