ci(repo): render mutation job failures from the failure record

[systemfsoftware-maker]

Layer 6 (plan unit U12).

The mutation job now decodes the stream's terminal record and renders the job summary and annotations through the contract renderers. When a run leaves no record, the job builds RecordMissing, JobTimedOut or BinaryMissing itself. A run that evaluated no mutants is reported as exactly that, not as a pass. The text "infrastructure failure (missing binary, crashed run or timeout)" is gone. stryker annotate also annotates failure.json.

Note: the dogfood lane runs the published CLI (START-6), so the CLI-side record reaches main's mutation lane only after a release.

Residuals

• The verdict-failed-from-cache case found in review is fixed in this layer: the summary label now keeps the outcome ("failure, evaluated no mutants").
• A non-zero gate for ran: 0 belongs to PR mode (plan U18). On main, a run that reuses every verdict is legitimate, so it is not gated here.
• scripts/deno.json keeps minimumDependencyAge: P1D with no new exclusion. A fresh Deno resolution refuses @systemfsoftware/vitest@1.0.0 until 2026-10-02T20:54Z, so excluding it would need operator approval.
• Not in this stack: plan U14, U15 and U19 wait for a release of systemfsoftware/systemfsoftware#576. U17 and U18 land as ci(repo): dry-run the main mutation lane once and keep its evidence #155 and ci(repo): run the mutation lane on pull requests and gate new survivors #156, under the workflow authorization the plan records in KTD19.
• check (macos-latest) on this layer (run 36958384168) timed out in vm-parity.differential.test.ts: the file took 330 s against its 280 s interrupt. This layer changes no runner, vm or vm-parity code; it touches only the annotate rendering, CI scripts and docs relative to L5. L5's macOS check passed in the same hour. The CI token cannot rerun jobs, so the rerun needs a maintainer.

[ryanleecode]

Reviewed by the merge conductor as part of the diagnostics stack. CI green on this head except where noted in the stack summary (macOS timeouts on #151 are flaky: the same code is green on macOS in #155 and #156; the #156 stryker-js mutation shard times out until main records its first full-cost timing, as this PR's description says). Merging into feat/agent-ready-failure-diagnostics with a merge commit.