CI: hermetic spawns in vex-vendor/rollback suites (#823) (#1518)

* Start fix for #823 (slice 17)

Assisted-by: Claude Code:claude-opus-5-5

* Spawn vex-vendor and rollback tests hermetically

e2e_vex_vendor.rs and rollback/rollback_multicopy_blob_gate.rs started
socket-patch with a bare Command::new and their own SOCKET_* sweep.
Both sweeps had drifted from the shared builder: the vex-vendor one
let an ambient SOCKET_NO_CONFIG=0 through, so a developer's real
`socket login` could reach the child, and neither forced the passive
update check off.

Both now spawn through tests/common/hermetic.rs and leave the
PENDING_RAW_SPAWNS list, so the spawn_env_hygiene ratchet keeps them
hermetic. Test-only change.

Refs #823

Assisted-by: Claude Code:claude-opus-5-5

* Use binary_command in vex-vendor suite

Matches e2e_vex.rs, which this suite cites, so the twin suites spawn
the CLI the same way.

Refs #823

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/tests/e2e_vex_vendor.rs

@@ -41,19 +41,11 @@ const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
 
 #[path = "common/mod.rs"]
 mod common;
-use common::binary;
 
-/// CLI invocation with the ambient `SOCKET_*` environment scrubbed (same
-/// rationale as `e2e_vex.rs`: explicit flags must be the sole source of
-/// truth).
+/// CLI invocation through the shared hermetic builder (same rationale as
+/// `e2e_vex.rs`: explicit flags must be the sole source of truth).
 fn cli() -> Command {
-    let mut cmd = Command::new(binary());
-    for (key, _) in std::env::vars() {
-        if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(key);
-        }
-    }
-    cmd
+    common::hermetic::binary_command()
 }
 
 /// Write `manifest` to `<cwd>/.socket/manifest.json`.
@@ -2310,8 +2302,6 @@ fn vex_json(cwd: &Path, extra: &[&str]) -> (Option<i32>, Value) {
     ];
     args.extend(extra.iter().map(|s| s.to_string()));
     let out = cli()
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
         .env("SOCKET_NO_API_TOKEN", "1")
         .args(&args)
         .output()

crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs

@@ -21,7 +21,7 @@ use std::path::{Path, PathBuf};
 use std::process::Command;
 use std::sync::{Arc, Mutex};
 
-use crate::common::{binary, git_sha256};
+use crate::common::{binary, git_sha256, hermetic_command};
 
 /// Minimal HTTP stub playing the authenticated API: serves `blob` bytes at
 /// any path ending in `/patches/blob/<hash>`, 404 otherwise, and records
@@ -161,19 +161,11 @@ fn build_diverged_two_copy_tree(root: &Path) -> (PathBuf, PathBuf, String, Vec<u
     (index_a, index_b, before_hash, original, patched)
 }
 
-/// A `rollback` command with the full `SOCKET_*` environment scrubbed and
-/// hermeticity vars pinned, so behavior is driven only by the flags under
-/// test (prefix scrub — an explicit list rots as flags are added).
+/// A `rollback` command through the shared hermetic builder, so behavior is
+/// driven only by the flags under test.
 fn rollback_cmd(cwd: &Path) -> Command {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
     cmd.arg("rollback").current_dir(cwd);
-    for (key, _) in std::env::vars_os() {
-        if key.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(&key);
-        }
-    }
-    cmd.env("SOCKET_NO_CONFIG", "1");
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
     cmd
 }
 

crates/socket-patch-cli/tests/spawn_env_hygiene.rs

@@ -33,8 +33,6 @@ const PENDING_RAW_SPAWNS: &[&str] = &[
     "e2e_maven.rs",
     "e2e_redirect_cargo_shapes.rs",
     "e2e_vendored_production.rs",
-    "e2e_vex_vendor.rs",
-    "rollback/rollback_multicopy_blob_gate.rs",
 ];
 
 /// The environment `cmd`'s child would see: the parent environment with