Docs: name the tiers that run each Maven pin

The Maven vendoring design doc said the PR tier pins five Maven
versions, but since lean CI only 3.9.16 runs on PRs and in the merge
queue; the rest, plus 3.9.3 and 3.9.4, run in the nightly full tier.
Also point two code comments that cite the Maven 4 release they were
checked against at rc-7, which the e2e suites now run and pass on.

Refs #267

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/tests/maven_build_common/mod.rs

@@ -34,7 +34,7 @@ pub const MVN_ENV: &str = "SOCKET_PATCH_MAVEN_E2E_MVN";
 pub const VERSION_ENV: &str = "SOCKET_PATCH_MAVEN_E2E_VERSION";
 pub const REQUIRED_ENV: &str = "SOCKET_PATCH_MAVEN_E2E_REQUIRED";
 
-/// What Maven 4's `CIDetector`s key on (4.0.0-rc-6 `cisupport`: generic
+/// What Maven 4's `CIDetector`s key on (4.0.0-rc-7 `cisupport`: generic
 /// `CI`, GitHub `GITHUB_ACTIONS`, CircleCI, Jenkins `WORKSPACE`, TeamCity,
 /// Travis). When one is set, Maven 4 swaps in the `QuietMavenTransferListener`
 /// even under `-B` — no "Downloading from …" lines and, crucially, no

crates/socket-patch-core/src/vex/discover/maven.rs

@@ -1547,7 +1547,7 @@ mod tests {
 
     /// REGRESSION: the vendored repository is `checksumPolicy=fail`, so the
     /// jar's `.sha1` sidecar is part of the wiring. With it stale or gone,
-    /// real Maven (3.6.3 → 4.0.0-rc-6, `e2e_vendor_maven_build`) rejects the
+    /// real Maven (3.6.3 → 4.0.0-rc-7, `e2e_vendor_maven_build`) rejects the
     /// file:// copy and silently resolves Central's pristine jar — while the
     /// committed members still hash-verify, so the ref must not attest a
     /// build that no longer consumes the patch.

docs/design/maven-vendoring.md

@@ -248,11 +248,12 @@ integration tests. Real-tool capstones exercise a Maven reactor from fresh
 checkouts, root and module invocations, Gradle strict locking and repository
 mode, existing verification metadata, offline builds, tamper detection and
 byte-exact revert; `e2e_vendor_gradle_build` covers each Gradle rule above
-against a fake Central, asserting on the jar Gradle actually consumes. The PR
-tier pins Maven 3.6.3, 3.8.9, 3.9.2, 3.9.16 and 4.0.0-rc-7 (macOS and Windows on
-3.9.16), and Gradle 6.9.4, 7.6.6, 8.14.3 and 9.8.0 on Linux, plus a Windows
-8.14.3 row; `gradle-compatibility.yml` runs every Gradle version on Linux,
-macOS and Windows nightly.
+against a fake Central, asserting on the jar Gradle actually consumes. PR and
+merge-queue runs pin Maven 3.9.16; the nightly full tier adds 3.6.3, 3.8.9,
+3.9.2, 3.9.3, 3.9.4 and 4.0.0-rc-7 (macOS and Windows on 3.9.16), and Gradle
+6.9.4, 7.6.6, 8.14.3 and 9.8.0 on Linux, plus a Windows 8.14.3 row;
+`gradle-compatibility.yml` runs every Gradle version on Linux, macOS and
+Windows nightly.
 
 Pre-v5 single-POM entries are not migrated: revert them and vendor again.
 Maven 4 implicit subproject discovery, build-time Maven strict pins, creating Gradle verification policy, and online