test: miri-clean + mutation-hardened

Adds tests/mutation_killers.rs with six targeted tests derived from
cargo-mutants findings: cad_enabled true/false paths, Transmit
with-config boundary, CobsDecoder::reset behaviour, empty-frame
handling, and the cobs_encode_response success path.

Three mutants remain as provably equivalent — the justfile excludes
them by exact regex so any genuinely new mutant on the same line will
still surface. Updates test-miri to also run the integration tests
(proptest stays skipped because its file-persistence layer calls
getcwd). Gitignore picks up mutants.out / mutants.out.old.

cargo mutants: 89 caught, 9 unviable, 0 missed.

justfile

@@ -46,14 +46,22 @@ test-fuzz:
     cd fuzz && cargo +nightly fuzz run cobs_roundtrip -- -max_total_time=60
 
 # run tests under miri (catches UB, requires nightly + miri component)
-# proptest is skipped — its file-persistence layer calls getcwd which miri does not support
+# The proptest suite is skipped — its file-persistence layer calls getcwd
+# which miri does not support. Vectors and unit tests run clean.
 test-miri:
-    cargo +nightly miri nextest run --lib
-    cargo +nightly miri nextest run --lib --no-default-features
+    cargo +nightly miri nextest run --lib --test vectors
+    cargo +nightly miri nextest run --lib --test vectors --no-default-features
 
-# mutation testing (requires cargo-mutants)
+# mutation testing (requires cargo-mutants).
+#
+# Three mutants are excluded as provably equivalent — swapping the
+# operator does not change behaviour because a downstream check catches
+# the resulting case. See the regex strings for the specific sites.
 test-mutants:
-    cargo mutants --no-shuffle
+    cargo mutants --no-shuffle --test-tool=nextest \
+        -E 'replace > with >= in Command::from_bytes' \
+        -E 'replace > with >= in CobsDecoder::feed' \
+        -E 'replace < with <= in cobs_encode_response'
 
 # format code
 fmt: