inventory: ingest macOS Homebrew cask inventory

[YMRYMR]

Summary

• extend the Phase 16 software inventory collector with macOS Homebrew cask discovery from local Caskroom directories
• capture cask version hints from a single installed version directory and prefer a discovered .app bundle name/path when one is unambiguous
• keep duplicate merges conservative so cask metadata can enrich a running process record without discarding its executable path

Why This Task

There are no remaining open agent-owned pull requests, review threads, or CI follow-up blockers after the merge of PR #177, so the roadmap becomes the primary prioritization signal again.

The next unfinished roadmap item is still Phase 16 Local software inventory and version discovery. The existing tree already covers running processes, service-backed identities, Windows uninstall entries, Debian dpkg, and Homebrew formulae. The smallest safe next slice is Homebrew cask inventory because it stays offline, uses local filesystem state only, and broadens installed-software visibility on a supported platform without jumping ahead into normalization or advisory matching.

Validation

• added focused unit coverage for casks with one app bundle, token-only casks, and ambiguous multi-version cask installs
• added duplicate-merge coverage to verify cask metadata can enrich a running process row without discarding its executable path
• reviewed the existing inventory merge ordering and kept the change isolated to src/software_inventory.rs
• I could not run cargo fmt, cargo test, or CI locally in this scheduled environment because the Rust toolchain and full repository checkout are unavailable here

Scope Notes

• this change only extends the existing macOS Homebrew inventory source set
• it does not yet add macOS app-bundle scanning outside Homebrew, cask artifact parsing beyond .app bundles, product normalization, or advisory scoring hooks

[YMRYMR]

Follow-up note from queue maintenance: I cleared the repo-wide rustfmt drift in src/process/mod.rs, src/software_inventory.rs, and src/ui/settings.rs, and the CI formatter is now down to a single remaining file.

The only current blocker on this PR is src/advisory_history.rs, with the exact cargo fmt --check diffs at the three spots reported in the latest CI run:

• stamp_sync_success should collapse the cache.sources.iter_mut().find(...) chain into the closure-wrapped single expression form
• stamp_sync_failure needs the same reflow
• unix_timestamp should be a single chained expression on one line under the current toolchain

Once that file is restyled to match Rust 1.94.1 rustfmt, the PR should be much closer to merge-ready.

[YMRYMR]

I inspected the failing CI run on this draft. The blocker is cargo fmt --check, and the reported formatting drift is in src/advisory_history.rs rather than in the new Homebrew cask inventory code.

The run is flagging these rustfmt-only spots:

• src/advisory_history.rs:694
• src/advisory_history.rs:735
• src/advisory_history.rs:996

The cask changes themselves look coherent and there are no unresolved review threads yet, but I’m leaving this in draft until the repo formatting drift is corrected and CI goes green.

[YMRYMR]

Scheduled follow-up check: there are still no review submissions, unresolved review threads, or requested changes on this draft.

I re-checked the failing CI run (25402922762). The only blocker is still cargo fmt --check in src/advisory_history.rs at the three previously reported spots. I also verified that src/advisory_history.rs currently resolves to the same blob SHA (c8dc52c5cfb3be55aa2dfbfb46754f9cb4cf8082) on this PR branch, its base commit (9cd2387bfc9e4101836f4c1b1f8d91e0ec34ee67), and current master, so the formatter failure is inherited from the base branch rather than introduced by the Homebrew cask changes.

I did not push a branch update from this scheduled environment because it still lacks a safe full Vigil source checkout and Rust toolchain, and the connector truncates large-file reads here; applying a full-file rewrite to fix rustfmt without complete local verification would have been riskier than leaving the branch unchanged.

[YMRYMR]

Maintainer pass update: the only failing signal on this draft is the CI workflow's Format & lint job, and the reported cargo fmt --check diffs are in src/advisory_history.rs, which is outside this PR's feature scope. I verified the same file contents are currently shared with master, so this looks like repo-level rustfmt drift rather than a defect in the Homebrew cask change itself. I’m leaving the PR unmerged for now because the required check is still red, but there are no review-thread blockers or other failing workflows at the moment.

[YMRYMR]

Maintainer follow-up: I opened #179 to track the base-branch rustfmt drift in src/advisory_history.rs that is keeping CI red on this draft. The failing Format & lint job on May 5, 2026 still reports only those three formatting-only edits, and they are shared with current master, so I’m leaving this PR unmerged until that repo-level blocker is cleared.