test: mutation testing — break dotup on purpose and check the suite notices

Each file in .tests/mutations/ is one deliberate bug: what it breaks, why that
matters, the assertion meant to catch it, and an OLD/NEW pair applied to a copy
of the tree. A mutation is KILLED only when the suite fails AND the named
assertion is among the failures — failing for an unrelated reason is reported
as WRONG-TEST, because that is luck, and luck is lost the next time the
unrelated test moves. A mutation whose OLD block no longer matches is STALE
rather than quietly skipped.

19 reproduces the DU-C1 shape: a comment moved back inside the fzf
line-continuation. It is killed by "dotup pick exits 0".

.tests/mutations/05-no-password-retry.mut

@@ -0,0 +1,13 @@
+# what: the password retry loop: any non-200 is fatal again
+# why:  these credentials are asked for after every package is installed; one typo used to cost the whole install
+# kills: …then asks again, keeping the URL
+# run:  unit
+<<<OLD
+		P_BLOB=''
+		say "  Try again, or type q at the URL prompt to stay public-only."
+	done
+<<<NEW
+		P_BLOB=''
+		return 1
+	done
+<<<END