`vexctl list <arg>` parses <arg> as a selector (status / justification),
not a file path. Switch to `vexctl merge --files <path>` which loads,
parses, and re-emits the document — the canonical single-file parse
gate at vexctl v0.3.x. A successful merge proves the input is valid
OpenVEX; we additionally assert the output round-trips through serde
as JSON.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

`vexctl merge` accepts file paths positionally, not via `--files`.
Verified locally with vexctl v0.3.0:

    $ vexctl merge ./out.vex.json
    { ... merged document ... }

Exit 0 with our generated doc confirms parse + schema validation
against the OpenVEX 0.2.0 spec.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ompleteness

Drives line coverage of `socket-patch-core::vex` to ~99.7% (1846/1851
lines covered) and locks down OpenVEX 0.2.0 spec conformance.

Schema additions (all `Option<T>`, all `skip_serializing_if = "Option::is_none"`,
no change to what the builder emits today):
- `Document.role`, `Document.last_updated`
- `Statement.@id`, `Statement.last_updated`, `Statement.supplier`,
  `Statement.action_statement`
- `Product.identifiers`, `Product.hashes`
- `Subcomponent.identifiers`, `Subcomponent.hashes`
Backwards-compatible: existing docs round-trip unchanged; new fields
appear only when callers set them.

Test count went from 33 to 144 across the vex module (+111 tests):
- schema.rs:  6 → 24 — every Status/Justification variant, all new
              optional fields, missing-required-field rejection,
              version typing, multi-aliases ordering.
- build.rs:   7 → 17 — applied PURL not in manifest, zero-vuln patch,
              empty CVE list, duplicate CVE dedup, tooling=None,
              empty author, determinism, timestamp consistency,
              subcomponent sort order.
- product.rs: 22 → 53 — `[tool.poetry]` fallback, CRLF git config,
              all URL scheme branches (git+ssh, git://, http://,
              port-suffix, no-user), no-origin/empty-url config
              fallbacks, multi-manifest combos beyond pkg+cargo,
              non-string JSON name/version, missing-version-key,
              parse_toml_kv negative cases, three-segment URL path,
              trailing-slash normalization.
- verify.rs:  5 → 11 — empty manifest, zero-file patch (vacuous),
              extra package_paths ignored, multi-file short-circuit,
              Default/Clone/Eq impls.
- time.rs:    5 → 15 — non-leap Feb, year-end boundary, century
              non-leap (2100), 400-year leap (2000), every
              month-length transition, u64::MAX no-panic.
- mod.rs:     0 → 1 — re-export smoke test (compile-time guard).
- conformance_tests.rs (new): 17 cross-cutting tests pinning OpenVEX
              spec rules — @context literal, JSON-LD @-prefixed keys,
              status/justification interaction (action_statement
              reserved for status=affected; not_affected requires
              justification), required-field presence, non-empty
              identifiers, timestamp consistency, version=1,
              no-null invariant, alias/subcomponent uniqueness.

Remaining 5 uncovered regions documented in-source as unreachable in
practice (e.g. `civil_from_days` negative-`z` arm — requires inputs
past year ~292 billion).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>