Sweep json_envelope, update_notifier, main, path_scope (#1967)

* Start sweep of json_envelope, update_notifier

Assisted-by: Claude Code:claude-opus-5-5

* Sweep json_envelope, update_notifier, main

update_notifier: inline in_ci, upgrade_command and grace_budget; one
millis_or parser for the timeout and grace knobs; guard types private;
the notice test compares exact plain and colored strings.

main/interrupt: the SIGPIPE reset moves into interrupt::install.

json_envelope: drop the unused sidecar re-export and the test-only
GcReport::to_value; usage_error prints through ui::print_json; trim
stale and history docs. Tests that claimed "every" action, command or
status now cover all variants; drop 4 duplicate tests and the JSON
string round trips.

path_scope: replace a tautological bind-vs-matches test and a
duplicate; add the relative --cwd strip case.

Assisted-by: Claude Code:claude-opus-5-5

* Clarify SIGPIPE reset and envelope scope docs

Assisted-by: Claude Code:claude-opus-5-5

* Restore the bare * path-scope assertion

The sweep dropped it together with a stale comment. No other test
covers a bare * pattern.

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/src/interrupt.rs

@@ -12,10 +12,16 @@
 //!
 //! Only an uncatchable kill (SIGKILL, power loss) can still leave the file,
 //! and the next lock-taking command reclaims and removes it.
+//!
+//! On Unix, [`install`] also resets SIGPIPE to its default disposition
+//! (unconditionally, unlike the signals above), so a pipe consumer that
+//! closes stdout ends the process quietly instead of a panic on EPIPE.
+//! Network writes still suppress SIGPIPE through std/socket2.
 
 use socket_patch_core::patch::apply_lock::cleanup_held_lock_on_interrupt;
 
-/// Install the interrupt handlers. Call once, first thing in `main`.
+/// Install the interrupt handlers (and, on Unix, the default SIGPIPE
+/// disposition). Call once, first thing in `main`, before any output.
 ///
 /// Unix: a signal the process started with ignored (`nohup`, a launcher
 /// that ignores Ctrl-C) keeps being ignored. The prompt's cursor guard
@@ -45,6 +51,10 @@ mod imp {
     }
 
     pub(super) fn install() {
+        // SAFETY: SIG_DFL is a valid disposition for SIGPIPE.
+        unsafe {
+            libc::signal(libc::SIGPIPE, libc::SIG_DFL);
+        }
         for sig in SIGNALS {
             // SAFETY: plain sigaction calls with zeroed, then filled,
             // structs; the handler only calls async-signal-safe code.