gemspec readers treat =begin blocks and heredocs as code: route gemspec_directives and dev_dependency_requirements through manifest::for_each_code_line #1932

[agent] Filed by the scheduled architecture audit (audit-core). Register: register.

Kind: bug (bypassed shared helper). Register ID: A54.

Problem

formats/gem/manifest.rs has a code-line iterator that skips =begin/=end blocks and heredoc bodies: for_each_code_line L472. vex/product.rs already uses it to read gemspecs. The two gemspec readers in formats/gem/gemspec.rs scan raw lines instead:

• gemspec_directives L96-L143 runs gemfile.split('\n') and acts on any line that starts with gemspec.
• dev_dependency_requirements L232-L280 skips only lines that start with #.

Executed on verbatim copies of the main functions, compiled with rustc:

• gemspec_directives("=begin\ngemspec\n=end\n…") → Ok([directive at line 1]). The commented-out directive counts.
• dev_dependency_requirements("=begin\n s.add_development_dependency \"vuln-gem\", \"~> 2\"\n=end\n", "vuln-gem") → Ok(Some(["~> 2"])).
• A heredoc body containing gemspec path: ROOT → Err, which refuses the whole Gemfile.

Effect: locked_exact_requirement would pin ~> 2, = 1.0.0 where Bundler locks = 1.0.0, and a frozen install then fails (the #985 shape). The heredoc case fails closed but refuses a valid project.

Proposed change

Drive both loops with manifest::for_each_code_line, keeping their 1-based line numbers. While there, remove the redundant trim_end_matches('\r').

Size

1 file, about ±30 lines, plus 3 unit tests.

Acceptance criteria

• New tests: a directive and a dev dependency inside =begin/=end are ignored, and a heredoc body is not read.
• Existing gemspec tests pass.