…on} projection (#182 follow-up) (#231)

Brings `cargo xtask ripr-pr` and `.github/workflows/ripr.yml` up to the
PR 1 spec that #230 partially shipped. Two surfaces change:

1. `cargo xtask ripr-pr [--base <ref>]`. Defaults to `origin/main`. The
   flag is currently forward-looking: `ripr pilot` operates on the working
   tree and has no `--base` flag, so the wrapper acknowledges and ignores
   non-default values today. The shape is stable for the eventual switch
   to `ripr check --base <ref>` once that format contract is something
   Shipper wants to consume.

2. Projection step after `ripr pilot` writes its native outputs:

      target/ripr/pilot/pilot-summary.md   ->  target/policy/ripr-report.md
      target/ripr/pilot/pilot-summary.json ->  target/policy/ripr-report.json

   So ripr's report sits alongside the other policy reports in
   `target/policy/` and a future `policy-report` integration can read it
   without crawling into ripr's per-mode directory layout. Each side is
   best-effort: a missing source is a quiet skip, not a wrapper failure.

   The JSON source is `pilot-summary.json` (~13 KB), not `repo-exposure.
   json` (~53 MB) or `agent-seam-packets.json` (~34 MB) which would be too
   heavy to republish as a CI artifact. The comment in `ripr.rs` records
   the choice.

3. `.github/workflows/ripr.yml`:
   - `cargo xtask ripr-pr --base origin/main` (explicit form for log
     legibility)
   - artifact upload glob expands from `target/ripr/` to
     `target/ripr/` + `target/policy/ripr-report.*`

Tests:

  ripr::tests::install_hint_mentions_pinned_version             (pre-existing)
  ripr::tests::install_hint_pinned_version_matches_workflow     (pre-existing)
  ripr::tests::project_one_skips_missing_source                 (new)
  ripr::tests::args_default_base_is_origin_main                 (new)

19/19 tests passing (15 no_panic + 4 ripr). Clippy and fmt clean.

Adds public README badges for `ripr` and `ripr+` as Shields endpoint
JSON committed under `badges/`. Per upstream ripr policy, README badges
must be repo-scoped — a diff-scoped artifact would read `0` on `main`
simply because no diff exists, not because the repo is clean. The
PR-time pilot artifact added in #230 stays diff-scoped and is never
republished as a README badge.

  cargo xtask repo-ripr-badge-artifacts

runs `ripr check --root . --mode ready --format repo-exposure-json`,
extracts `metrics.headline_eligible` (the count of repo seams the
configured `[severity.seams]` policy treats as non-off), maps the
number to a Shields color, and writes both endpoint files. The command
REQUIRES `ripr` on PATH — unlike `cargo xtask ripr-pr` which is
advisory locally, regenerating badges with stale numbers is worse than
failing loud.

Threshold mapping for Shields color:

  0          brightgreen   (inbox-zero goal)
  1..=99     yellowgreen
  100..=999  orange
  1000+      red

Initial Shipper count: 2,711 (red). Both badges currently project the
same count; differentiating `ripr+` to include unsuppressed
test-efficiency findings is upstream territory and deferred.

Receipts and metadata:

  policy/generated-allowlist.toml   `badges/*.json` glob, kind
                                    `shields_badge_endpoint`,
                                    classification `generated`
  .gitattributes                    `badges/*.json` linguist-generated
  README.md                         two new badges (ripr, ripr+) linking
                                    docs/ci/ripr.md
  docs/ci/ripr.md                   new "Repo Badges" section: scope
                                    (repo not diff), Shields URLs,
                                    schema, regen command, threshold
                                    mapping, refresh cadence

Refresh cadence is intentionally manual — the badge is a repo health
endpoint, not a PR tax. An optional workflow_dispatch refresh job is
mentioned as a future extension but not added here.

Tests:

  ripr::tests::shields_color_thresholds       (new)
  ripr::tests::write_shields_endpoint_shape   (new)

21/21 tests passing.

* feat(ci): mutation testing PR-time lane + cargo xtask mutants-pr (#182 PR 3)

Adds a label-gated PR-time mutation lane and the xtask wrapper it
invokes, keeping mutation off every PR's hot path while making it cheap
to opt in when warranted.

  cargo xtask mutants-pr --changed [--base origin/main] [--dry-run]

is a thin wrapper around `cargo-mutants` that:

  1. Refuses to run without `--changed`. Whole-workspace mutation is
     intentionally not part of the PR-time lane — that lives in the
     weekly schedule (see docs/ci/test-evidence-lanes.md).
  2. Computes `git diff <base>...HEAD --name-only -- '*.rs'`, filters
     out `tests/` and `benches/` paths (cargo-mutants only mutates
     production source).
  3. Runs `cargo mutants --no-shuffle --file <each-path>` (or `--list`
     when `--dry-run` is passed).
  4. If `cargo-mutants` is missing locally, prints install instructions
     and exits advisory-success rather than erroring. CI installs the
     tool before invoking.
  5. Surfaces `cargo mutants` non-zero exit codes — surviving mutants
     are load-bearing failures, unlike ripr's purely advisory findings.

`.github/workflows/mutation.yml` adds the `mutants-pr` job alongside
the existing `mutants-weekly` job. The PR job's gate:

  if: github.event_name == 'pull_request' && (
    contains(github.event.pull_request.labels.*.name, 'mutation') ||
    contains(github.event.pull_request.labels.*.name, 'full-ci')
  )

The weekly job's crate list stays unchanged (shipper-duration,
shipper-types, shipper-config). Expanding it to the full trust-critical
surface (shipper-core, shipper-encrypt, etc.) is too expensive for a
60-minute job and is its own future rollout step; the policy stays
about routing, not coverage scope.

  xtask/src/mutants.rs          new — 3 unit tests
  xtask/src/main.rs             `mutants-pr` subcommand wiring
  .github/workflows/mutation.yml   two-job split (mutants-weekly +
                                   mutants-pr)
  docs/ci/test-evidence-lanes.md   advisory-routed table + targeted
                                   mutation section updated
  CHANGELOG.md                  Added entry

Tests:

  mutants::tests::install_hint_mentions_cargo_install    (new)
  mutants::tests::args_defaults_are_explicit             (new)
  mutants::tests::changed_requires_the_flag              (new)

24/24 tests passing.

Refs #182 (this is the third PR in the #182 sequence: advisory lane in
#230, --base + projection in #231, badges in #232, mutation scoping
here).

* fix(xtask): wrap mutants-pr doc-comment Behaviour block in fenced code

`<REF>` inside a doc comment is parsed by rustdoc as an invalid HTML tag
under `-D rustdoc::invalid-html-tags` (implied by RUSTDOCFLAGS=-D
warnings on the CI Documentation job). Wrap the whole Behaviour block in
a ```text fence so the angle brackets are literal.