test: mutation testing — break dotup on purpose and check the suite notices

Each file in .tests/mutations/ is one deliberate bug: what it breaks, why that
matters, the assertion meant to catch it, and an OLD/NEW pair applied to a copy
of the tree. A mutation is KILLED only when the suite fails AND the named
assertion is among the failures — failing for an unrelated reason is reported
as WRONG-TEST, because that is luck, and luck is lost the next time the
unrelated test moves. A mutation whose OLD block no longer matches is STALE
rather than quietly skipped.

19 reproduces the DU-C1 shape: a comment moved back inside the fzf
line-continuation. It is killed by "dotup pick exits 0".

.tests/mutations/14-no-npm-one-at-a-time.mut

@@ -0,0 +1,8 @@
+# what: the npm one-at-a-time retry, removed
+# why:  same shape as apt: one bad spec takes every other tool down with it
+# kills: …then @openai/codex on its own
+# run:  unit
+<<<OLD
+		for p in $specs; do run_sh "$NPM install -g $p" || note_fail "$(keyof npm "$p")" "npm install failed"; done
+<<<NEW
+<<<END