Scope platform-specific mutation wrappers

[hbrodin]

Summary

• exclude OS-specific secret-store arms when they are compiled out on the mutation host
• exclude Linux network command wrappers whose effects are covered by the Firecracker and isolated-network integration gates
• keep cross-platform parsing and network policy helpers in mutation scope

Tests

• cargo mutants -f src/network.rs -f src/secret_store.rs -- --lib (81 tested: 50 caught, 31 unviable, 0 missed)
• cargo mutants --list -f src/network.rs -f src/secret_store.rs
• taplo format --check .cargo/mutants.toml
• git diff --check