feat: promote maven and nuget to fully available — retire the SOCKET_EXPERIMENTAL_* gates

[Mikola Lysenko (mikolalysenko)]

Summary

Maven and NuGet were the last two ecosystems behind runtime opt-ins: the SOCKET_EXPERIMENTAL_MAVEN / SOCKET_EXPERIMENTAL_NUGET env gates silently dropped them from discovery in every flow — scan (all modes), apply, get, rollback, vendor, repair, vex, setup. This PR retires the gates entirely: both ecosystems now crawl and patch unconditionally, like everything else. Setting the old env vars is harmless but does nothing.

Product changes

• ecosystem_dispatch.rs: the gates, the "N patch(es) skipped — support is experimental" warnings, and env_truthy are deleted. Maven/NuGet become plain scan_ecosystem! / crawl! branches. crawl_covers_purl now only exempts pkg:<type>/s this build has no crawler for (the newer-CLI-in-a-committed-manifest case).
• Prune GC: scan --prune/--sync now judges maven/nuget manifest entries like any other ecosystem's. While the gate was closed they were exempt from pruning; with the crawl always on, "absent from the scan" genuinely means uninstalled.

Behavior notes

• A default scan now walks the local Maven repository (~/.m2 / MAVEN_REPO_LOCAL) and the NuGet caches.
• The in-place sidecar caveat is unchanged and now documented per mode in docs/ecosystems.md: agent-mode patching leaves Maven's .jar.sha1/.jar.md5 stale, and NuGet's post-apply fixup deletes .nupkg.metadata + raises an advisory for the signed-package .nupkg.sha512 marker. The vendored/hosted modes never touch the caches.
• Follow-up worth considering: Maven has no entry in patch/sidecars/ (not even advisory-only, unlike pypi/gem/go) — with in-place maven apply now ungated, an advisory-only maven fixup would give downstream tooling the same structured signal nuget emits.

Tests

• The four #[ignore = "experimental ecosystem"] dispatch e2e tests (dispatch_branch_{maven,nuget}, rollback_dispatch_branch_{maven,nuget}) are un-ignored — they now gate CI and pass.
• Every SOCKET_EXPERIMENTAL_* export/set is stripped from the suites: docker capstones, the setup-matrix driver (run-case.sh), and the rollback / remote-apply / safety-advisory / dispatch fixtures.
• New pins:
  • crawl_all_includes_every_ecosystem_unconditionally — a resurrected runtime gate turns this red.
  • find_packages_resolves_maven_without_any_opt_in — the PURL-lookup path resolves a local-repo maven artifact with no env.
  • detect_prunable_judges_maven_and_nuget_like_any_ecosystem — replaces the old gate-exemption GC test.
  • scan_discovers_maven_and_nuget_in_every_mode (in-process) — default, --mode hosted, and --mode vendored scans all POST the maven/nuget purls to the batch endpoint with no opt-in.

Docs

README, docs/ecosystems.md (matrix rows now unconditional with the sidecar caveat; the "discovery gate" blockquote replaced), CLI_CONTRACT.md env-table rows removed, both crates' Cargo.toml comments, and a CHANGELOG entry (two older [Unreleased] passages amended so the section doesn't contradict itself at release time).

Verification

• Full workspace test suite: green. Clippy: clean.
• All four maven/nuget docker capstones pass against freshly built images (the suites bake the binary at image-build time, so stale local images still carry the gated binary — rebuild Dockerfile.base before running them locally):
  • maven_install_full_apply_chain, nuget_{local,global}_install_full_apply_chain — agent-mode scan→apply→vex chains, now with no -e SOCKET_EXPERIMENTAL_* in the container env.
  • maven_vendor_fresh_checkout_install_and_revert, nuget_vendor_fresh_checkout_install_and_revert — vendor capstones with the exports removed from the stage scripts.

🤖 Generated with Claude Code

---

Note

Medium Risk
Behavior change for operators who relied on gates to skip maven/nuget crawls and prune exemptions; in-place agent apply for those ecosystems still leaves cache checksum sidecars stale, now reachable without opt-in.

Overview
Maven and NuGet are always discovered and patched — the SOCKET_EXPERIMENTAL_MAVEN / SOCKET_EXPERIMENTAL_NUGET runtime gates are removed from ecosystem_dispatch.rs (including experimental skip warnings and env_truthy). scan, apply, get, rollback, vendor, repair, vex, and setup now crawl ~/.m2 / MAVEN_REPO_LOCAL and NuGet caches like other ecosystems; setting the old env vars has no effect.

Prune/sync behavior changes: crawl_covers_purl no longer exempts maven/nuget when gates were off, so scan --prune / --sync can drop manifest entries for maven/nuget packages absent from the crawl.

Tests and docs: Four maven/nuget dispatch e2e tests are un-#[ignore] for CI; docker/setup-matrix and other suites drop experimental env exports. New regression tests pin unconditional crawl, maven lookup without opt-in, prune GC for maven/nuget, and batch discovery in default/hosted/vendored scan modes. README, docs/ecosystems.md, CLI_CONTRACT.md, and CHANGELOG reflect full availability and document unchanged in-place cache sidecar caveats (vendored/hosted still avoid touching caches).

^{Reviewed by Cursor Bugbot for commit 38a389b. Configure here.}