feat(repo): give every failure record a one-step reproduction

[systemfsoftware-maker]

Layer 4 (plan units U7 and U13).

• FailedTestResult.reproduce: the Vitest runner supplies vitest run <file> -t <full test name> for each failed test.
• A new pure workflow reproduction-capsule.workflow.ts decides each record's capsule:
  • the runner's command, run under the STRYKER_WORKER_DIR mutation-worker budget;
  • stryker run --dryRunOnly when the runner supplies no command;
  • stryker run --mutant <ids> for new survivors;
  • DoesNotReplay with its reason and a stand-in (worker kind, pid and exit code for crashed workers).
• A gate refusal never suggests --update-baseline.

Residuals

• enterprise-runner-resilience e2e failed twice on this layer (runs 36956858432 and 36958384090) and passed on L5 and L6, which carry the same code. The failures are timing in the fixture, not a change in this stack. Five rest-1 traces across L4 and L5 show the mechanism. Each mutant reloads its environment, and a mutant that lands on a freshly spawned worker (capabilities 2.7-3.0 s) runs its first cold vitest pass in 1.3-1.9 s. The mutant deadline comes from the dry run and was 1.5-2.0 s in these traces. When the cold pass outruns the deadline, a mutant annotated Killed (BlockStatement in b4fb8f19 and 2e6bf590, AssignmentOperator in 1cf3ee06) reports Timeout. The real fix is to keep a worker's cold start out of the mutant deadline; that is not part of this stack. The CI token cannot rerun jobs (gh run rerun: "Resource not accessible by personal access token").

[ryanleecode]

Reviewed by the merge conductor as part of the diagnostics stack. CI green on this head except where noted in the stack summary (macOS timeouts on #151 are flaky: the same code is green on macOS in #155 and #156; the #156 stryker-js mutation shard times out until main records its first full-cost timing, as this PR's description says). Merging into feat/agent-ready-failure-diagnostics with a merge commit.