fix CI: admit maven at the vendor service gate; clippy manual_strip

- Add "maven" to SERVICE_ECOSYSTEMS in the vendor dispatch gate. The
  maven backend has a full service path (prebuilt jar download +
  registry pom) and its own errors advise --vendor-source=service,
  which the gate dead-ended with vendor_service_unsupported_ecosystem.
  Unblocks the PR #117 regression guard service_mode_gate_admits_maven
  failing on all platforms. Also syncs the stale ecosystem list in the
  comment and refusal message (both omitted nuget and maven).

- vex/product.rs: use strip_prefix instead of manual starts_with +
  slice (clippy::manual_strip, -D warnings).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/src/commands/vendor.rs

@@ -109,22 +109,25 @@ pub(crate) async fn dispatch_vendor_one(
     let eco = ecosystem_dir_for_purl(purl)?;
 
     // Prebuilt service downloads now cover every vendorable ecosystem: npm,
-    // pypi, cargo, golang, composer, and gem. Gem's `.gem` archive doesn't
-    // carry the eval-able stub gemspec a bundler path source wants, so the
-    // converter generates it and serves it as a `gem-stub-gemspec` second
-    // artifact alongside the `.gem` (the gem backend downloads + verifies both).
+    // pypi, cargo, golang, composer, gem, nuget, and maven. Gem's `.gem`
+    // archive doesn't carry the eval-able stub gemspec a bundler path source
+    // wants, so the converter generates it and serves it as a
+    // `gem-stub-gemspec` second artifact alongside the `.gem` (the gem backend
+    // downloads + verifies both).
     // Under fail-closed `service` mode, refuse any not-covered ecosystem with a
     // clear message rather than silently building (which would violate the
     // contract). Under `auto`/`build` they fall through to the local build.
-    const SERVICE_ECOSYSTEMS: &[&str] =
-        &["npm", "pypi", "cargo", "golang", "composer", "gem", "nuget"];
+    const SERVICE_ECOSYSTEMS: &[&str] = &[
+        "npm", "pypi", "cargo", "golang", "composer", "gem", "nuget", "maven",
+    ];
     if let Some(cfg) = service {
         if cfg.source.requires_service() && !SERVICE_ECOSYSTEMS.contains(&eco) {
             return Some(VendorOutcome::Refused {
                 code: "vendor_service_unsupported_ecosystem",
                 detail: format!(
                     "--vendor-source=service is not supported for `{eco}` \
-                     (prebuilt downloads cover npm, pypi, cargo, golang, composer, and gem); \
+                     (prebuilt downloads cover npm, pypi, cargo, golang, composer, \
+                     gem, nuget, and maven); \
                      use --vendor-source=auto or --vendor-source=build"
                 ),
             });

crates/socket-patch-core/src/vex/product.rs

@@ -140,13 +140,13 @@ fn scan_toml_section(content: &str, section: &str) -> Option<(String, String)> {
         if line.is_empty() || line.starts_with('#') {
             continue;
         }
-        if line.starts_with('[') {
+        if let Some(rest) = line.strip_prefix('[') {
             // A header may carry a trailing comment (`[package] # x`)
             // and whitespace inside the brackets (`[ package ]`) —
             // both valid TOML that cargo and tomllib accept. Anything
             // else after the closing bracket means a different (or
             // malformed) section.
-            in_section = match line[1..].split_once(']') {
+            in_section = match rest.split_once(']') {
                 Some((inner, after)) => {
                     let after = after.trim_start();
                     (after.is_empty() || after.starts_with('#')) && inner.trim() == section