fix(test): reject mutation-harness false positives and honor fixture trust

[wolfv]

Stack: follows #200.

• Require successful unmodified verification before attempting mutations.
• Treat crashes, timeouts, usage/setup errors and unrecognized rejection diagnostics as harness errors, not passing mutations.
• Pass supplied trusted-root files to the Rust verifier.
• Add offline --trusted-root support to the verification example; custom TUF instances now require --tuf-root rather than silently trusting a writable cache.
• Add standard-library Python regression tests.

Validation: Python unittest checks, real offline baseline plus signature-bit mutation, and strict example Clippy. /usr/bin/false now exits the harness with status 2 rather than reporting every mutation passed. External verifier diagnostic changes intentionally require updating rejection markers.

[wolfv]

Added the small fixture/expectation changes previously in #205 here: stricter baseline checks now come with an offline CI fixture set in the same PR. This avoids leaving this PR dependent on a later CI repair.