Keep one purl builder round-trip test

Each builder now round-trips through its parser with a literal +
version, replacing the 14 deleted builder and round-trip tests with
one that fails when a builder and its parser disagree. The pipenv
probe's unused root parameter is named _root.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-core/src/utils/pipenv.rs

@@ -42,7 +42,7 @@ fn parse_major(output: &str) -> Option<u32> {
 /// when none is found, it does not answer within 10 s, exits non-zero or
 /// prints something unrecognizable. [`MAJOR_OVERRIDE_ENV`] short-circuits
 /// the probe.
-pub async fn installed_major(root: &Path) -> Option<u32> {
+pub async fn installed_major(_root: &Path) -> Option<u32> {
     if let Some(forced) = std::env::var(MAJOR_OVERRIDE_ENV)
         .ok()
         .and_then(|value| parse_override(&value))
@@ -56,7 +56,6 @@ pub async fn installed_major(root: &Path) -> Option<u32> {
     // NEUTRAL directory: with the scanned repository as cwd, Pipenv would read
     // its `.env`, `Pipfile` and `.venv` pointer — committed, attacker-shaped
     // inputs that must not influence (or slow down) a version check.
-    let _ = root;
     command
         .arg("--version")
         .current_dir(std::env::temp_dir())

crates/socket-patch-core/src/utils/purl.rs

@@ -561,6 +561,46 @@ mod tests {
         );
     }
 
+    /// Each builder's spelling parses back to its parts, including a
+    /// literal (already decoded) `+` version.
+    #[test]
+    fn builders_round_trip_through_their_parsers() {
+        let version = "1.0.0+meta";
+        assert_eq!(
+            nv(parse_cargo_purl(&build_cargo_purl("wasi", version))),
+            Some(("wasi".into(), version.into()))
+        );
+        assert_eq!(
+            nv(parse_gem_purl(&build_gem_purl("rails", version))),
+            Some(("rails".into(), version.into()))
+        );
+        assert_eq!(
+            nv(parse_nuget_purl(&build_nuget_purl("Foo.Bar", version))),
+            Some(("Foo.Bar".into(), version.into()))
+        );
+        assert_eq!(
+            nv(parse_golang_purl(&build_golang_purl(
+                "golang.org/x/text",
+                version
+            ))),
+            Some(("golang.org/x/text".into(), version.into()))
+        );
+        assert_eq!(
+            nv3(parse_maven_purl(&build_maven_purl("org.x", "lib", version))),
+            Some(("org.x".into(), "lib".into(), version.into()))
+        );
+        assert_eq!(
+            nsv(parse_composer_purl(&build_composer_purl(
+                "psr", "log", version
+            ))),
+            Some((("psr".into(), "log".into()), version.into()))
+        );
+        assert_eq!(
+            jsr_parts(&build_jsr_purl("@std", "path", version)),
+            Some(("@std".into(), "path".into(), version.into()))
+        );
+    }
+
     /// The namespace and name halves are decoded too — and the split runs on
     /// the ENCODED text, so an escaped separator stays INSIDE the component
     /// it was written in instead of creating a new one (the path-safety