[moloch--]

Summary

• Select Git and non-workspace path dependencies from Cargo metadata while preserving workspace and registry selection.
• Allow an optional exact package_id to disambiguate packages with the same source type, name, and version.
• Reject selection when distinct Cargo package IDs share a manifest directory, since rustc invocations cannot be attributed to one ID safely.
• Document the selectors and add a local Git/path end-to-end regression that verifies exact package IDs, transformed effects, sibling exclusion, and program output.
• Reproduce the same-checkout Git ref collision and verify the wrapper rejects it before compilation.

Local verification

• cargo fmt --manifest-path tools/rust-obfuscation/cargo-wrapper/Cargo.toml -- --check
• cargo test --locked --manifest-path tools/rust-obfuscation/cargo-wrapper/Cargo.toml (11 passed)
• python3 -B tests/obfuscation/rust/test_cargo_wrapper.py with the pinned Rust 1.99/LLVM 23 compiler
• python3 -B tests/obfuscation/rust/test_cargo.py --online with the pinned Rust 1.99/LLVM 23 compiler and local LLVM tools