Add patchcheck, check vendor patch

[dagood]

Add patchcheck util command. Wire it up with selftest so CI automatically runs it.

patchcheck runs deterministic tests on our patch files without involving submodule state. Currently just includes a rule for the vendoring patch based on what it looks like now. (It can always be easily adjusted later. We can also add more rules.)

Copilot review doesn't want to touch the vendoring patch, presumably because it's huge. But what we ask it to do there seems like it can be tooled, so instead, Copilot can write this tool.

Ran into a Git oddity similar to this: https://stackoverflow.com/q/42386491. Copilot floundered (reflecting a lack of docs), even just asking it questions.

Moved testutil/dependency_test.go‎ to internal/dependency_test.go because it doesn't make sense to put tests into testutil just because they're tests. Tests generally belong in the package they're testing. So, along with putting the patchcheck tests in the patchcheck package, remove the potentially misleading testutil package.

[Copilot]

Pull request overview

Adds a new _util “patchcheck” facility to validate repository patch files (especially the vendor patch) deterministically, without applying patches or relying on submodule state. This fits into the eng/_util tool suite and CI/selftest workflow by providing a repeatable check over patches/*.patch.

Changes:

• Introduces an internal patchcheck package that inspects patch modifications via git apply --numstat and enforces vendor-patch path constraints.
• Adds a patchcheck command under eng/_util/cmd to run the checks and report issues.
• Adds new tests: one to fail the build if patch issues are found, and one to enforce minimal dependency rules for _util commands.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
eng/_util/internal/patchcheck/vendoronly.go	Implements vendor-patch-only path rules and vendor patch identification.
eng/_util/internal/patchcheck/patchcheck.go	Core patch scanning logic (walk patches, parse numstat, report issues).
eng/_util/internal/patchcheck/patchcheck_test.go	Runs patchcheck in tests and fails on any issues.
eng/_util/internal/dependency_test.go	Adds enforcement that _util command packages keep dependencies minimal.
eng/_util/cmd/patchcheck/patchcheck.go	Adds CLI entry point for running patch checks from eng/run.ps1.