Add Infection command integration to evaluate mutation testing coverage

[coisa]

Problem

Mutation coverage is not currently represented in fast-forward/dev-tools quality gates.

tests catches regressions on example inputs, but it does not measure whether test suites would detect changed control-flow behavior under mutant execution.

Proposal

Evaluate and implement an optional infection integration under dev-tools as a new command and optional CI stage.

Possible shape:

• Add a command wrapper for vendor/bin/infection with predictable default configuration (source paths from local package, PHPUnit compatibility).
• Include a cached baseline config file and default baseline generation strategy.
• Gate execution behind a dedicated flag or dedicated workflow input so lightweight runs remain fast.
• Document minimum runtime and expected timeout budget in the command docs.

Goals

• Provide a clear path for mutation-driven quality checks without forcing all projects to run it by default.
• Define deterministic command output and exit behavior suitable for automation.
• Keep it additive to current code-style/tests flows.

Expected Benefits

• Higher confidence on behavioral regressions and branch conditions that PHPUnit assertions may miss.
• Better triage signal for weakly-asserted tests in the ecosystem.
• Optional hardening option for larger repositories.

Why Not (if skipped)

• Full mutation testing can be expensive and can slow PR validation for small repos.
• Baselines can be noisy in early adoption.

Non-goals

• Replacing PHPUnit or existing quality commands.
• Enforcing mutation thresholds at repository level on day one.
• Running mutation tests on every repository that consumes dev-tools by default.

Acceptance Criteria

• A command is available to run Infection with documented defaults and local-first config fallback.
• composer dev-tools default behavior remains unchanged unless explicitly enabled.
• Integration is covered with a reproducible usage note in docs and CLI help output.

Architectural / Isolation Criteria

• MUST: Command orchestration and tool execution are isolated from output formatting/decision logic.
• MUST: Command options (--cache-dir, --json, --progress style behavior if relevant) follow the existing command conventions.
• MUST: Exit behavior is deterministic and machine-readable with --json.