Count registry = "crates-io" as re-pinnable in the Cargo remedy

Second review round. The unpinned-declaration remedy sent every
declaration with an explicit `registry` key to "it names another
registry ... roll the patch back", including `registry = "crates-io"`,
which the hosted rewriter re-pins (#386); it now says a re-scan pins it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: claude

crates/socket-patch-core/src/vex/discover/cargo.rs

@@ -947,7 +947,10 @@ fn beside_the_pin(
     let refused: Vec<String> = unpinned
         .iter()
         .filter_map(|(d, selects)| {
-            let why = match (&d.source, d.registry.as_deref(), selects) {
+            // `registry = "crates-io"` is crates.io itself, which the
+            // rewriter re-pins like a declaration with no `registry` (#386).
+            let registry = d.registry.as_deref().filter(|r| r.trim() != "crates-io");
+            let why = match (&d.source, registry, selects) {
                 (DeclSource::Registry, None, CargoReqMatch::Ours) => return None,
                 (DeclSource::Registry, None, _) => {
                     let also: Vec<&str> = others
@@ -2167,6 +2170,19 @@ mod tests {
             "{}",
             u.detail
         );
+        // Review on #2019 (round 2): `registry = "crates-io"` is crates.io,
+        // which a re-scan re-pins (#386).
+        let p = mixed_workspace(
+            &pinned("serde", "=1.0.1", UUID_A),
+            "serde = { version = \"1\", registry = \"crates-io\" }",
+            &[],
+        );
+        let u = run(&p).await.unattested.remove(0);
+        assert!(
+            u.detail.contains("re-run `socket-patch scan`"),
+            "{}",
+            u.detail
+        );
 
         // `"1"` also matches the crates.io 1.0.200 locked beside it.
         let p = mixed_workspace(