fix(repo): make mutation CI fail truthfully and actually mutate

[systemfsoftware-maker]

Summary

Mutation CI now fails when a package produces no mutation report, and every package really gets mutated. Before this, run 36160660790 showed green while all three jobs had failed: the Mutation step had continue-on-error, the report check accepted the stream file every run writes, and merge-reports exited 0 after merging 0 of 3 reports.

What changes

• Mutation lane. It now follows the systemfsoftware setup. A plan job sizes jobs from recorded timings, a matrix runs them, then the timings and report jobs run. There is no continue-on-error. A package that leaves no mutation-report.json fails its job with a ::error annotation, while a low score alone does not. Outputs from an earlier run are deleted before each run, including when a package is skipped because its job budget ran out. Oversized packages are split with shardMutate. It runs on pushes to main and manual dispatch only.
• Plugins load from node_modules. Each package's stryker.config.ts called import.meta.resolve with its own package name. Node answered through the package's own exports, so the config loaded the package's unbuilt dist/ (exit 4). installedPlugin now resolves the published catalog:stryker copy.
• Dry runs finish. stryker-js and stryker-vm-harness use a vitest.mutation.config.ts limited to unit and property tests. The integration and differential suites had pushed the dry run past its 5-minute limit (exit 3).
• CLI output (minor bump). Piped stdout now gets human output. NDJSON goes to stdout only with --json or STRYKER_MODE=machine; in that mode stdout carries nothing else, and stderr carries no echo of each event. reports/mutation-stream.jsonl is written in both modes. Anything that parsed NDJSON from a piped stryker run without asking for it must add --json.
• Partial reports rebuild. stryker merge-reports now reads the stream's _tag:"mutant" records. It had been decoding kind:"mutant", so a stream never rebuilt anything.
• TypeScript checker. Each mutant is now checked against the files it changes plus their dependents, instead of asking for diagnostics of the whole program every time.

Checker on its own package (157 mutants)	Result
Before	0/157 after 240 s, killed
After	157/157 in 35 s

On a 4-mutant sample, the new checker returned the same statuses as the published 7.1.0.

Review notes

A multi-reviewer pass found 10 actionable findings, and all of them are fixed on this branch. The fixes include decoding every script input with effect Schema instead of casting it, and adding tests for shardMutate, installedPlugin, buildSummary, the incomplete-part rebuild, and the --json argv probe. One finding claimed that the merge-reports flags changed. They did not: the base commit already declares --parts/--out (Cli.parts.ts), and this branch only corrects a stale README example.

Validation

• pnpm format:check, pnpm typecheck, pnpm check:ci, pnpm test and pnpm test:scripts pass on this head.
• A local mutation-job run on the checker package, using the published 7.1.0 checker, printed Mutation produced no report and exited 1. A stubbed run that crashed and left an old report behind also failed.
• The CLI and checker changes reach this workflow only after they are released, because mutation runs the published CLI through catalog:stryker.

---

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}