test: port Composer tests unblocked by mockall, add seams

Port 11 categories of previously-ignored Composer tests now reachable with
the mockall crate: DownloadManager, VCS/Perforce/File downloaders,
VersionSelector, PlatformRepository, Auditor, installer/FilesystemRepository,
RootPackageLoader, util auth/http, commands, and Cache.

Extract test seams additively on concrete structs as *Interface traits
(Runtime, HhvmDetector, VersionGuesser, RepositorySet, Perforce,
BinaryInstaller) plus mock-field seams (Cache, Filesystem); consumers take
trait objects. Mocks are defined locally in the test crates via
mockall::mock!, since automock-generated mocks are cfg(test)-gated and
invisible across the integration-test boundary.

dataProviders are ported in full; tests blocked by unported shims stay
#[ignore] with documented reasons rather than reduced or weakened.

Fix product bugs surfaced by the ports:
- util/github: use the exception code, not the HTTP status, for 401/403
- advisory: serialize empty audit maps as [] to match PHP json_encode
- repository/filesystem and downloader/file: fix RefCell double-borrow panics

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1 files changed, 38 insertions, 0 deletions

diff --git a/crates/shirabe/src/advisory/auditor.rs b/crates/shirabe/src/advisory/auditor.rs
index 627b900..4331b7b 100644
--- a/crates/shirabe/src/advisory/auditor.rs
+++ b/crates/shirabe/src/advisory/auditor.rs
@@ -23,6 +23,7 @@ use crate::util::PackageInfo;
 /// Shape of the `--format=json` audit output.
 #[derive(serde::Serialize)]
 struct AuditJsonReport<'a> {
+    #[serde(serialize_with = "serialize_advisories_field")]
     advisories: &'a IndexMap<String, Vec<AnySecurityAdvisory>>,
     #[serde(rename = "ignored-advisories", skip_serializing_if = "Option::is_none")]
     ignored_advisories: Option<&'a IndexMap<String, Vec<AnySecurityAdvisory>>>,
@@ -31,9 +32,46 @@ struct AuditJsonReport<'a> {
         skip_serializing_if = "Option::is_none"
     )]
     unreachable_repositories: Option<&'a Vec<String>>,
+    #[serde(serialize_with = "serialize_abandoned_field")]
     abandoned: IndexMap<String, Option<String>>,
 }
 
+/// PHP `json_encode` emits an empty associative array as `[]`, not `{}`. Mirror that so an empty
+/// map serializes as an empty JSON array.
+fn serialize_php_array<S, V>(map: &IndexMap<String, V>, serializer: S) -> Result<S::Ok, S::Error>
+where
+    S: serde::Serializer,
+    V: serde::Serialize,
+{
+    use serde::ser::SerializeSeq;
+    if map.is_empty() {
+        let seq = serializer.serialize_seq(Some(0))?;
+        seq.end()
+    } else {
+        serializer.collect_map(map.iter())
+    }
+}
+
+fn serialize_advisories_field<S>(
+    map: &&IndexMap<String, Vec<AnySecurityAdvisory>>,
+    serializer: S,
+) -> Result<S::Ok, S::Error>
+where
+    S: serde::Serializer,
+{
+    serialize_php_array(*map, serializer)
+}
+
+fn serialize_abandoned_field<S>(
+    map: &IndexMap<String, Option<String>>,
+    serializer: S,
+) -> Result<S::Ok, S::Error>
+where
+    S: serde::Serializer,
+{
+    serialize_php_array(map, serializer)
+}
+
 /// @internal
 #[derive(Debug)]
 pub struct Auditor;