vendor's download plan re-walks the vendor loop's candidate selection, and the copy skips the vlt refusal and the ambiguous-variant check #1909

[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register comment.

Kind: refactor. Register ID: T36 (related to T06).

Problem

vendor_records_reusing decides which candidates get a vendor grant twice:

• In plan_service_downloads L2786-L2930, which plans the batched downloads.
• In the main vendor loop, L3303-L3420.

Both copies do the same work: the .socket/vendor/.uninstalled stand-in for a superseded install, representative_file + verify_file_patch + variant_matches_installed, variant-group resolution, the Bun refusal, linked_vendor_dir_refusal and the takeover gate. The plan's comments point at the loop instead of saying what they do ("The loop's installed-variant probe (see there)", "refuses it as ambiguous (see there)", L2801, L2829, L2856-L2857).

The copies have drifted:

• The loop refuses vlt-routed packages (L3400-L3408). The plan only checks bun_refusal (L2861) and takes no vlt input. That contradicts the plan's own doc, "a package the loop refuses is never granted" (L3252-L3258). I have not executed this; vlt_lock::preflight_packages may hide it in practice.
• The loop records vendor_variant_ambiguous (L3379). The plan silently drops an ambiguous candidate.
• The plan matches through get_key_value, the loop through its own lookup.

On top of that, the .socket/vendor/.uninstalled path is built 4 times in production (L1936, L2802, L3151, L3302).

Proposed change

• Extract one vendor_candidates(...) -> Vec<Candidate { purl, record, source, verdict }>, where the verdict is Vendor | Refuse{code, detail} | Ambiguous, from the loop's version.
• plan_service_downloads maps the Vendor verdicts to PlannedDownload. The loop renders the refusals and runs the downloads.
• Add a const UNINSTALLED_REL.

Size

vendor.rs only. About −90 / +40 lines.

Acceptance criteria

• Vendor output and envelopes are unchanged on the vendored e2e suites.
• New unit test: a vlt-refused candidate is not in the plan.
• The variant_probe unit tests stay green.