Preserve Python patches across uv lockfiles

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Codex:gpt-6-astra

Keep hosted and vendored Python patches installed across uv native locks, PEP 751 locks, compiled requirements, and PEP 723 script locks. Hosted native rewrites now replace the registry source and preserve the matching artifact hash and wheel metadata; paired project/script metadata keeps patches installed during ordinary and --locked installs as well as frozen installs.

Hashed requirements retain extras and environment markers while replacing complete hash continuations. Version-specific rewrites preserve other conditional versions. Paired script/project rewrites refuse competing versions or source conflicts before changing either file. Vendored scripts and standalone PEP 751 locks use local patched wheels, and inventory/repair recognizes their references.

Validation

• Full default workspace test suite: 6,803 passed, 0 failed, with 97 pre-existing ignored tests. All-features library tests passed (3,455 core + 543 CLI), and all-features test compilation passed. Hosted lockfile integration and shared golden tests also passed.
• cargo clippy --workspace --all-features -- -D warnings passed.
• Real public socket-patch CLI scans and uv installs across 14 versions, covering every pre-1.0 minor family from 0.0–0.12, plus the 0.6 lock revision boundary: 230 installed-byte comparisons passed, with no mismatches. Native locks, plain/hashed requirements, exports, standalone pylock, and script locks are included where supported.
• All 99 lock-preservation checks passed. Frozen, locked, and ordinary installs were checked against the published patch's installed-file SHA-256. Vendored frozen checks use a cold cache and offline mode where supported.
• Real universal hashed requirements preserve an unpatched conditional version byte-for-byte, keep two patched versions' hashes separate, and pass fresh hash-verified installs. Real competing-version project/script probes refuse mutation and preserve both paired files.
• The complete matrix ran against source commit e11bd419ea9c01b3ecd1aa894b55874718a3ff0a on macOS arm64 with CPython 3.9.6. The compatibility report includes exact commands, binary hashes, per-version results, and sanitized supplemental evidence. This covers every release family, not every patch release or operating system.

uv 0.0 has no native lock format and rejects local wheel paths. Portable native vendoring explicitly requires uv 0.2 or newer; hosted rewriting supports the historical uv 0.1 distribution format. Exports, script locks, and PEP 751 are tested only on versions that implement those formats. Global uv sources cannot safely represent competing conditional versions, so those paired rewrites are explicitly refused.

Companion scanner annotation PR: https://github.com/SocketDev/depscan/pull/26136. Both changes are developed in separate worktrees; the scanner keeps fixtures from the released CLI alongside output from this change.