test(config): mutation hardening to break 95 and release readiness

[msalvatti]

Summary

Final phase: mutation-test hardening to a Stryker break threshold of 95, plus release readiness. No new features and no public API changes (surface frozen).

What changed

• Mutation gate green. Baseline 89.11% raised to 95.72% (246 killed, 11 survived), exit 0 against break: 95. All 11 remaining survivors are documented equivalent mutants, handled by documentation rather than inline disables (no suppression comments in src/).
• Hardened suites. Behavioral assertions added for error non-configurability (delete throws), the acronym source-name boundary, per-namespace parse-candidate isolation and the deterministic first-issue collapse, and the placeholder synthesizer boundaries (inclusive URL/email length bounds, the lone exclusive-range integer, the boolean token, exact-length precedence). Coverage stays at 100%.
• Public-gated CI/release. New mutation.yml workflow (manual dispatch plus weekly cron) and the release.yml publish job are gated if: ${{ github.event.repository.private == false }}, consistent with the CodeQL and Scorecard workflows, so they activate automatically once the repository is public. Stryker concurrency capped at 2.
• Docs. docs/mutation_testing_plan.md and docs/mutation_testing_results.md record the thresholds, survivor catalog, per-file scores, and every equivalent with its technical reason. A README "Releasing" section documents the go-live sequence.

Verification

• pnpm mutation: 95.72% (break 95 PASS, exit 0).
• pnpm test:cov:all: 100% line/branch/function/statement across both jest configs.
• pnpm prepublishOnly (typecheck, lint, coverage, build, size, dogfood) and pnpm build && pnpm test:e2e: green.
• pnpm publish --dry-run: resolves registry.npmjs.org (public access, version 0.1.0) and packs only dist/, LICENSE, README.md, CHANGELOG.md (plus package.json), 14 files total.
• Invariant greps for em dashes and phase/task references in src/ and .github/: empty.

Follow-ups

Go-live is a deferred manual step performed by the maintainer: make bymaxone/nest-config public, then push the v0.1.0 tag from main to trigger the OIDC provenance publish, then run the post-publish smoke (a scratch consumer installs the released version and boots the fixture). This PR wires everything for that go-live but does not make the repository public, tag, or publish.

[Copilot]

Pull request overview

This PR completes the final “mutation-hardening + release readiness” phase by raising the Stryker mutation break threshold to 95, adding targeted tests to kill prior survivors, documenting the remaining equivalents, and wiring public-repo–gated CI workflows for mutation testing and publishing.

Changes:

• Raised mutation-testing gate requirements (break/low at 95) and reduced Stryker concurrency to 2.
• Added behavioral assertions to harden tests around placeholder synthesis boundaries, source-name derivation boundaries, env-validation aggregation/isolation, and error property immutability.
• Added documentation for mutation testing plan/results and updated release/go-live guidance; added a public-gated mutation.yml workflow and gated release.yml publish job.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
stryker.config.json	Lowers Stryker concurrency to bound resource usage while meeting the new break threshold.
src/testing/placeholder-synthesizer.spec.ts	Adds boundary assertions for URL/email length inclusivity, exclusive integer ranges, boolean tokens, and exact-length precedence.
src/source-mapping.spec.ts	Pins acronym-to-word boundary behavior for stable env var name derivation.
src/errors.spec.ts	Adds delete-throws assertions to ensure error contract properties are non-configurable.
src/env-validator.spec.ts	Adds tests for per-namespace isolation on collisions and deterministic “first issue” collapse semantics.
README.md	Documents the CI-driven release/go-live sequence and its public-repo prerequisites.
docs/tasks/README.md	Updates phase index to mark Phase 7 complete.
docs/tasks/phase-07-mutation-hardening-release.md	Marks Phase 7 tasks complete and updates prompts/fencing and completion log.
docs/mutation_testing_results.md	Adds the mutation testing results report, per-file scores, and equivalent mutant catalog.
docs/mutation_testing_plan.md	Adds the mutation testing plan, thresholds, scope, and baseline survivor catalog.
docs/development_plan.md	Updates overall progress to 100% and notes deferred manual go-live steps.
.github/workflows/release.yml	Gates the publish job on repository visibility (public) for provenance/security workflow alignment.
.github/workflows/mutation.yml	Adds a public-gated mutation workflow (manual + weekly cron) with least-privilege permissions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.