Sweep scan/discovery.rs (#1884)

* Start sweep of scan/discovery.rs

Assisted-by: Claude Code:claude-opus-5-5

* Test shell_word, supersedes and layout in place

Move the tests for ui::shell_word, ranking::batch_supersedes and
lock_inventory::unsupported_layout_warnings next to the code they
check. scan/discovery.rs tested them through wrappers and re-exports
that the next commit deletes. The shell_word test now covers the
Windows quoting and `%`.

Assisted-by: Claude Code:claude-opus-5-5

* Sweep scan/discovery.rs

Drop the re-exports of unsupported_layout_warnings and
merge_ledger_records_for_updates; scan and get import them from core.
Inline candidate_supersedes and the severity_order wrapper into their
callers, and delete the 5 severity_order tests core's ranking tests
already cover.

The nested-project remedy now quotes its PATH with ui::shell_word, so
on Windows it is double-quoted and a `%` is quoted everywhere (#1859).

Trim restating doc comments and test banners, and fold the trailing
collect_vuln_ids dedup test into its siblings.

Assisted-by: Claude Code:claude-opus-5-5

* Address review of the discovery sweep

Fold the last info_with_advisories caller onto patch_with, and make
the comment over scan's discovery re-exports name what they export.

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/src/commands/get.rs

@@ -908,7 +908,8 @@ async fn filter_to_installed_purls(
         }
     }
 
-    let warnings = super::scan::unsupported_layout_warnings(&pnp_diags);
+    let warnings =
+        socket_patch_core::vendor::lock_inventory::unsupported_layout_warnings(&pnp_diags);
     let pnp_yarn = pnp_diags
         .iter()
         .any(|d| d.code == "vendor_yarn_berry_unsupported");