safety(audit): cargo-mutants reaches 98% coverage on the unsafe-touching codegen

The earlier safety-audit run reported 16/53 missed mutants in
compute_transition_paths and concluded the LCA depth-walk wasn't
covered by tests. Wrong diagnosis. cargo-mutants infers the
test-package from the file under mutation, so without an explicit
override it ran only the hsmc-macros per-package test set
(essentially trybuild fixtures). All the asymmetric-depth lateral
coverage in det_lateral.rs et al. is in the hsmc/ workspace tests
and was sitting on the bench.

With `--test-package hsmc --features hsmc/tokio,hsmc/journal`:

  codegen.rs safety fns:  51/53 (14 caught + 37 unviable + 2 missed)
  hsmc/src/lib.rs:        48/48 (45 caught + 3 unviable + 0 missed)
  total:                  99/101 = 98%

The 2 remaining are equivalent mutants — transformations that
provably produce identical __PATH_RANGE / __PATH_DATA output and
so cannot be distinguished by any behavior test:

  1. `da > db` → `da >= db` in the LCA depth-equalizer:
     the mutated loop walks `a` one extra step in the equality case;
     the next loop (`while db > da`) compensates symmetrically.
     parent(root) = None short-circuits any walk past root. Same
     LCA, same paths. Verified by hand on lateral, up-transition,
     and asymmetric-depth (4↔2) inputs.

  2. `from != to && is_strict_ancestor(...)` → `from == to && ...`:
     becomes always-false (a state isn't its own strict ancestor),
     so the up-transition branch is dead code. Up-transitions then
     fall through to the lateral branch, which computes
     lca(from, to) = to (target is ancestor of source), walks
     source up to (exclusive of) to, and produces an empty enter
     path. Same paths.

Both are documented in docs/004 § "The two equivalent mutants".

Updates:
- justfile `just safety`: add the correct flags so future runs
  reproduce 99/101 instead of the misleading 37/53.
- docs/004: corrected mutants section, equivalent-mutant analysis,
  removed the false "asymmetric-depth test gap" claim.

justfile

@@ -171,8 +171,17 @@ safety:
     just miri
     echo ""
     echo "4/4 — Mutation testing on safety-relevant codegen fns..."
-    cargo mutants -p hsmc-macros \
-        -F "compute_transition_paths|compute_terminate_paths|compute_event_dispatch" \
+    # `--features hsmc/tokio,hsmc/journal --test-package hsmc` is
+    # essential: the safety-relevant tests (det_lateral, det_up,
+    # det_descent, etc.) live in hsmc/tests/ and are gated on those
+    # two features. Without them, cargo-mutants runs only the
+    # hsmc-macros per-package test set and large swathes of the
+    # LCA / path-derivation logic look uncovered when they aren't.
+    cargo mutants \
+        --regex "compute_transition_paths|compute_terminate_paths|compute_event_dispatch" \
+        --features hsmc/tokio,hsmc/journal \
+        --test-package hsmc \
+        --test-tool nextest \
         --jobs 4 --no-shuffle
     echo ""
     echo "✅ Unsafe audit complete. See docs/004. unsafe-safety-contract.md"