Adds Infection as a dev-dependency, configures it to mutate src/ against the
new `unit` testsuite, and ships composer scripts (`composer infection`,
`composer test:everything`) to run mutation tests locally and in CI.

74 new test assertions kill 74 of the 89 escaped mutants reported on v5.1.1;
Covered MSI rises from 86% to 97%. Suite: ~295 → 342 unit tests, 543 → 1031
assertions. See WAR_AGAINST_THE_MUTANTS.md for the per-tier breakdown,
equivalent mutants left in place, and the remaining ObjectAclManipulator
escapes flagged for follow-up.

No production code change vs v5.1.1 (verify: `git diff v5.1.1 -- src/`).