test(mutations): use offline fixtures and correct Rekor v2 expectations

[wolfv]

Small follow-up to #204.

Run mutation CI against three checked-in fixtures with explicit local roots. Rekor v2 authenticates its checkpoint, not duplicate proof roots/tree sizes, log-ID hints or integratedTime, so those v1-only rejection expectations no longer apply to v2. Authenticated checkpoint mutations remain covered.

Validation: Python harness unit tests and all applicable mutations on message-signature, Rekor v1 DSSE and Rekor v2 DSSE fixtures passed offline.

[wolfv]

Folded these fixture/expectation checks into #201, so the harness PR has working offline mutation CI on its own. No code was dropped; #206 now follows #204.