ci: add mutation testing

[roxblnfk]

What was changed

• Infection runs on every PR and on pushes to master (PHP 8.4, Xdebug); pushes to master send the report to the Stryker dashboard, and the README shows its badge.
• Covered Code MSI in CI is 83%, so --min-msi=80.
• Only the Unit suite runs under Infection: acceptance tests start php-cs-fixer in a subprocess, so they collect no coverage and cannot kill a mutant.
• src/Rules/DefaultRules.php is excluded from mutation: it is a rule list, and killing "drop rule X" mutants would need a test that duplicates the list.

Why?

Line coverage shows what tests execute; mutation testing shows what they actually check.

Review notes

• Infection is installed in the job (infection/infection + testo/bridge-infection), not from the Phar and not in composer.json: the Phar's bundled Testo adapter writes an unscoped class into the mutant bootstrap and every mutant fails with "class not found", and Infection needs PHP 8.3+.

Checklist

• Closes: no issue
• Tested
  • Infection runs locally and in CI
  • Unit tests added