Build the Pipenv stale-install remedy in one core helper: hosted scan and vendored pypi each write it, and the copies drifted #1878

[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register comment.

Kind: refactor. Register ID: T26.

Problem

When an unpatched release is still installed, Pipenv will not reinstall it. Both hosted scan and vendored pypi tell the user what to do, and each builds that remedy itself. Both copies sort the stale sites into three classes (inherited base site, a venv copy shadowing the base, the venv's own copy) and pick the matching pypi_pipenv::*_remedy text:

• CLI: scan/hosted/python.rs L134-L205
• core: vendor/pypi.rs pipenv_stale_install_warning L786-L860

A third copy of the "Pipenv does not reinstall a release that is already present…" sentence is in commands/pypi_reinstall.rs L86-L89.

The copies have drifted (verified by reading):

• Warning count. Hosted emits one warning per (site, purl). Vendored aggregates every site into one warning per purl, with a For <dirs>: lead when the sites fall into more than one class.
• Suffix. Hosted says "socket-patch vex --product <purl> re-verifies", with a literal <purl> placeholder. Vendored says "socket-patch vex re-verifies".
• Name parsing. Hosted hand-splits the purl (strip_prefix("pkg:pypi/") + split('@')), falling back to the literal <package>. Vendored uses parse_pypi_purl and falls back to the whole purl. This is one of the A14 copies.
• Order of checks. Hosted checks the inherited class before the shadowing probe, per site. Vendored partitions all sites first.

Proposed change

• Add a core vendor::pypi_pipenv::stale_install_detail(lock, name, version, sites) -> String. It does the partition and wording once.
• pipenv_stale_install_warning calls it, and so does hosted python.rs; hosted keeps its own warning code and its lead sentence.
• Replace hosted's hand purl split with parse_pypi_purl.
• Fix the <purl> placeholder: substitute the purl.

Size

3 files. Roughly −70 / +30.

Acceptance criteria

• Vendored warning text is unchanged. The vendor/pypi.rs pipenv stale tests guard it.
• Hosted's detail names the actual purl rather than <purl>.
• A unit test covers the shared helper for each of the three site classes.
• Move the CLI test that re-tests core categories (python.rs L369) to core or delete it.