feat!: migrate patch command to @socketsecurity/socket-patch@1.2.0

BREAKING CHANGE: Replace custom built-in patch implementation with external
@socketsecurity/socket-patch package, following the same integration pattern
as Coana and SFW.

Changes:
- Add socket-patch@1.2.0 to external-tools.json
- Create socket-patch spawn utility (src/utils/socket-patch/spawn.mts)
- Add SOCKET_CLI_SOCKET_PATCH_LOCAL_PATH environment variable support
- Replace 30+ custom patch files with simple wrapper that delegates to socket-patch
- Move old custom implementation to patch-old/ for reference
- Add INLINED_SOCKET_CLI_SOCKET_PATCH_VERSION to env constants

BREAKING CHANGE: External tool version getters now throw errors instead of
returning empty strings when versions are missing from external-tools.json.
This affects getCoanaVersion(), getSwfVersion(), and getSocketPatchVersion().

Benefits:
- Consistent external tool integration pattern across CLI
- Reduces maintenance burden (socket-patch maintained separately)
- Users get socket-patch updates without CLI releases
- Simplified codebase (~30 files → 1 wrapper)

Ported from v1.x commits:
- 44655ac: Use @socketsecurity/socket-patch for patch command (#987)
- dfe019d: feat: update @socketsecurity/socket-patch to v1.2.0 (#1030)

Author: jdalton

CHANGELOG.md

@@ -8,6 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 - Updated Coana CLI to v14.12.148.
+- Updated to @socketsecurity/socket-patch@1.2.0.
 
 ### Fixed
 - Prevent heap overflow in large monorepo scans by using streaming-based filtering to avoid accumulating all file paths in memory before filtering.

packages/cli/external-tools.json

@@ -24,6 +24,12 @@
     "package": "socketsecurity",
     "version": "^2.2.15"
   },
+  "socket-patch": {
+    "description": "Socket Patch CLI for applying security patches",
+    "type": "npm",
+    "package": "@socketsecurity/socket-patch",
+    "version": "1.2.0"
+  },
   "sfw": {
     "description": "Socket Firewall (sfw)",
     "type": "standalone",