[codex] use syntax-aware mutation locations

[greenthree]

What changed

• replace regex/token mutation candidate discovery with a pinned Tree-sitter C++ syntax locator
• keep valid cpp-token-v1 mutation IDs stable while making legacy token evidence stale under the new locator fingerprint
• limit candidates to function/lambda compound-statement bodies and exclude templates, macros, declarations, unevaluated syntax, if constexpr conditions, and case labels
• pin binary wheels for tree-sitter==0.26.0 and tree-sitter-cpp==0.23.4
• add a bounded Doctor parser smoke and clean-install coverage
• add canonical UTF-8 and LF/CRLF fixtures, parser failure/evidence compatibility tests, and updated user/Skill documentation

Why

Token scanning could confuse C++ syntax such as template angle brackets, operator declarations, macros, and compile-time contexts with executable expressions. The AST-backed locator removes those false candidates without changing IDs that still point to the same runtime expression.

User impact

probhub mutation now produces a smaller, more auditable plan and fails closed when the pinned parser cannot safely locate the source. Existing exclusion IDs continue to match when their runtime expression remains valid; old token-only false positives become unmatched. Mutation remains advisory and is not a build gate.

Validation

• npm run check: 702 passed, 30 skipped
• npm run pack:check: probhub=222, probhub-skill=5
• clean-install delivery flow passed for 0.6.6
• Python dependency audit: 12 dependencies, 0 vulnerabilities
• Skill quick validation passed
• git diff --check passed
• phtest nine-problem Schema v1 lint passed; worktree remained clean
• same-model ultra read-only review found no remaining merge blocker

Follow-up boundary

The ROADMAP retains native parser worker isolation and typeid(type) grammar compatibility as separate follow-up work.