fix(lint): clean lint debt + repair import paths

`pnpm run check --all` now passes 0 errors (lint + TypeScript).
`pnpm vitest run test/unit/packages/edit.test.mts` passes
83/83 tests (the pkgJsonToEditable concern was already resolved).

- scripts/util/run-command.mts, scripts/lint.mts,
  scripts/util/changed-test-mapper.mts: socket-lib's package
  `exports` map uses granular paths (./spawn/spawn, ./argv/flag-
  predicates, ./git/changed, ./git/staged) — not the consumer-
  facing barrels (./spawn, ./argv/flags, ./git). The cascaded
  wheelhouse scripts assumed barrels; rewrote imports to match
  socket-lib's actual exports.
- bulk import rewrite across 23 scripts/ files: `from
  '@socketsecurity/lib/spawn'` → `from '@socketsecurity/lib/spawn/
  spawn'`; `from '@socketsecurity/lib/argv/flags'` → `from
  '@socketsecurity/lib/argv/flag-predicates'`
- .config/vitest.config.mts + .config/vitest.config.isolated.mts:
  the earlier catalog-rename sed produced a duplicate
  `@socketsecurity/lib` key (one each from `lib` and `lib-stable`
  → both becoming `lib`); de-duplicated.
- 65 files autofixed by oxlint --fix (export-top-level-functions,
  sort-source-methods, etc.)

Author: jdalton

.config/oxlint-plugin/lib/rule-tester.mts

@@ -34,9 +34,8 @@ const vitestConfigIsolated = defineConfig({
       'fast-sort': path.resolve(projectRoot, 'src/external/fast-sort'),
       pacote: path.resolve(projectRoot, 'src/external/pacote'),
       '@socketregistry/scripts': path.resolve(projectRoot, 'scripts'),
-      // Both names resolve to src/ — `lib` is the canonical published
-      // name, `lib-stable` is the fleet-wide infra alias.
-      '@socketsecurity/lib': path.resolve(projectRoot, 'src'),
+      // Resolve `@socketsecurity/lib` to local src/ so test files don't
+      // pull in the published version through the pnpm overrides block.
       '@socketsecurity/lib': path.resolve(projectRoot, 'src'),
     },
   },

.config/oxlint-plugin/rules/no-logger-newline-literal.mts

@@ -41,9 +41,8 @@ const vitestConfig = defineConfig({
       'fast-sort': path.resolve(projectRoot, 'src/external/fast-sort'),
       pacote: path.resolve(projectRoot, 'src/external/pacote'),
       '@socketregistry/scripts': path.resolve(projectRoot, 'scripts'),
-      // Both names resolve to src/ — `lib` is the canonical published
-      // name, `lib-stable` is the fleet-wide infra alias.
-      '@socketsecurity/lib': path.resolve(projectRoot, 'src'),
+      // Resolve `@socketsecurity/lib` to local src/ so test files don't
+      // pull in the published version through the pnpm overrides block.
       '@socketsecurity/lib': path.resolve(projectRoot, 'src'),
     },
   },