Fix: Refuse to confirm golang redirects when workspace selection is Unknown

When the workspace graph is Unknown, we cannot prove what version the
workspace actually builds. An existing socket replace directive might be
from an apply pin, vendor pin, or written under GOWORK=off, none of which
prove the workspace uses that version.

This fix ensures that Unknown workspace selection always refuses to write
and confirm redirects, regardless of whether a same-version prior replace
exists, preventing false confirmation of potentially inert pins.

Author: cursoragent

crates/socket-patch-core/src/patch/redirect/mod.rs

@@ -9575,7 +9575,8 @@ fn rewrite_golang_target(
         }
         return false;
     } else if selection != go_build_list::Selection::Selected
-        && prior.is_none_or(|e| e.version.as_deref() != Some(dep.version.as_str()))
+        && (selection == go_build_list::Selection::Unknown
+            || prior.is_none_or(|e| e.version.as_deref() != Some(dep.version.as_str())))
     {
         // Not selected by go.mod's require, no go.sum zip line at this
         // version, and not already redirected by us: the module is