Tracking: move the patch engines out of the CLI command modules into core #894

[agent] Filed by the scheduled architecture audit routine (CLI and core). Register: register comment.

Kind: tracking. Source: review §2.1, Part 2.3, R11; register C12. Coordinate with E32 (one hosted pipeline) and E36 (one inventory).

Problem (re-measured on 9c43dfc)

The CLI crate still holds engine code with no output concerns, and command modules call each other as libraries:

• ecosystem_dispatch.rs#L1-L950 has 950 production lines (816 at the review). It is the only purl → installed-paths locator in the workspace. Core has no find_by_purls dispatch of its own, so the Node addon and any future core orchestrator can't locate packages. The only CLI type it depends on is GlobalArgs, which it reads for ecosystems, crawler_options(), is_global() and cwd.
• vendor_records_reusing is 1,044 lines (962 at the review).
• run_redirect_selected is 932 lines (836 at the review).
• The get ↔ scan cycle is still there. get.rs names scan:: 33 times. Scan imports get::{download_and_apply_patches_with, DownloadParams, DownloadRun} (scan/mod.rs#L36), as well as decide_patch_action and short_uuid. scan/vendor_flow.rs imports get::download_patch_records_reusing.
• get runs the agent apply by building CLI args. run_nested_apply rebuilds a GlobalArgs with ..GlobalArgs::default() and an ApplyArgs { nested: Some(..) }, then calls apply::run_locked.

Target design

• Core owns the engines: a locator (crawlers::locate), the agent download + apply pipeline, the vendored orchestrator and one hosted pipeline (E32).
• Each engine takes a small typed scope instead of GlobalArgs, and returns results or events that the CLI renders.
• Command modules only parse arguments, build the scope, call core and render. No command module imports another.

Children (in order; each lands as one PR)

• 1. Move ecosystem_dispatch.rs into core as crawlers::locate, behind a LocateScope (mechanical): Move ecosystem_dispatch's purl locator out of the CLI into core as crawlers::locate #895.
• 2. Move the agent download engine (download_and_apply_patches_with, download_patch_records_reusing, DownloadParams, DownloadRun, decide_patch_action, short_uuid) out of commands/get.rs into a shared commands/agent_download.rs, so that scan no longer imports get. This is a mechanical move that breaks the cycle.
• 3. Replace run_nested_apply's fake ApplyArgs/GlobalArgs with a typed apply entry point (apply::run_engine(ApplyPlan, &ApiClient, LockGuard)), and delete nested_apply_args* and NestedApply. This waits on Tracking: build one RunCtx in main and stop mirroring CLI flags into the process environment #793 (RunCtx).
• 4. Split vendor_records_reusing into plan → stage → commit phases in core's vendored backend. This waits on child 1 and on E-area vendored work.
• 5. Move run_redirect_selected into the single hosted pipeline (register E32, which depends on E44), which deletes the CLI copy.

Acceptance

• crates/socket-patch-cli/src/commands/* has no super::<other command>:: engine imports.
• No engine function in the CLI is longer than 200 lines.
• The CLI's production line count drops by the moved total.

Consolidated work — backlog review, 2026-10-08

The following standalone issues are now tracked here. Their closure consolidates scheduling; it does not mean their implementation is complete. Original reports and discussion remain linked below.

#895: Move ecosystem_dispatch's purl locator out of the CLI into core as crawlers::locate

• Track the remaining scope from Move ecosystem_dispatch's purl locator out of the CLI into core as crawlers::locate #895 in this issue. Explicit locator-move child of the core-engine tracker; preserve its scope as a checklist step.