fix(manifest): write JVM Socket facts into the build's own root

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

Second step of the #1587 stack. The Maven, Gradle and sbt scripts now report the build's root directory, and the facts file is written there. Previously mvn -f sub/x.xml or gradle -p dir wrote it to cwd, where its build-root-relative paths don't resolve. The file name is unchanged.

• New buildRoot record from all three scripts. A build that doesn't report one fails instead of guessing.
• Recursive discovery (--dynamic-sbom-inference) resolves subprojectDir against the build root, and only counts a module as covered when it is the build root or inside it. A module that escapes a relocated reactor still gets its own run.

No Coana dependency.

Stack: #1589 → this → #1591 → #1587

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes where facts files land and how monorepo discovery classifies coverage; incorrect buildRoot reporting would break path resolution or skip/generate the wrong modules.

Overview
Fixes JVM Socket facts placement when the build is rooted away from the CLI working directory (mvn -f, gradle -p). Maven, Gradle, and sbt now emit a buildRoot line in their records protocol; the CLI writes .socket.facts.json there (not in cwd) and fails closed if the tool does not report a root.

Recursive manifest discovery (--dynamic-sbom-inference) resolves subprojectDir against that reported build root and treats nested coverage relative to buildRoot, not the discovery directory—so relocated reactors still skip in-tree modules correctly while sibling/escaped modules keep their own run.

Changelog documents the fix; unit tests cover parsing, write location, missing buildRoot, and relocated-root coverage.

^{Reviewed by Cursor Bugbot for commit 3e2edef. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3e2edef. Configure here.}