docs: repair merge damage in the mutation ledger

[aaearon]

What happened

PRs #63-#69 were seven stacked branches, each carrying its own edited copy of
docs/mutation-ledger.md. Squash-merging them in sequence appended both the
pre-work and the post-work version of many rows, so 48 row IDs appeared twice
inside the ## Ledger table (SFU-01..22, CACHE-01..07, CFG-01..09,
UI-01..10). No pair was byte-identical — each differed in Status, and often in
the planned-test cell and the File:line reference — so this needed a per-row
decision, not uniq.

Survivor rule

1. done beats todo. All seven PRs are merged, so done is the accurate
   state. This picked the survivor for all 48 IDs. It also happens to pick the
   richer copy every time: the done copies carry the post-review corrections and
   the test names that actually landed, while the todo copies name tests that
   were only planned (e.g. TestSortRolesForDisplay_MixedCase,
   TestExtractBinary_RejectsNonRegularEntries — neither exists on main).
2. No row was invented by splicing cells from two copies.

236 rows before → 188 after. Unique IDs: 188 before, 188 after — no row lost
(verified by diffing the sorted ID sets against origin/main).

Rows rewritten because the production site is gone

• UI-02 — recorded against sort.SliceStable in sortGroupsForDisplay
  (internal/ui/group_selector.go). fix(ui): resolve interactive selections by index, not display text #68 deleted SelectGroup,
  sortGroupsForDisplay and resolveGroupSelection as having zero production
  callers, and its planned test TestSortGroupsForDisplay_Ordering does not exist
  on main. Repointed at the two surviving display sorts —
  sortTargetsForDisplay (internal/ui/selector.go:69) and buildUnifiedOptions
  (cmd/selection.go:62) — both pinned, including their stability mutants. Note
  group_selector.go itself survives with FormatGroupOption /
  BuildGroupOptions; only the selector half was deleted.
• UI-08 — same deletion took the if len(groups) == 0 guard in SelectGroup.
  The surviving equivalent is the len(items) == 0 guard in
  uiUnifiedSelector.SelectItem (cmd/root.go:1005), which nothing pins:
  TestUnifiedSelector_NonTTY covers only the guard that precedes it. Row
  rewritten and flipped back to todo, with the successor test named.
• ELV-01 — findItemByDisplay was replaced by the index-based
  resolveSelectionItem in fix(ui): resolve interactive selections by index, not display text #68. Its Planned test cell still named
  TestFindItemByDisplay_ReturnsMatchingItem, which was never added and now cannot
  be. Repointed at TestResolveSelectionItem,
  TestResolveSelectionItem_EmptySlice and
  TestUIUnifiedSelector_PTY_DuplicateGroupDisplay, all of which exist.

Other corrections

• Eight of the nine cmd/favorites.go rows cited stale lines. The preamble's
  "+13 shift" no longer applies now that test: isolate the suite from real user state, and wire integration tests into CI #63's guard is merged; re-verified against
  the file and corrected (OUT-02 258→261, OUT-03 388→391, OUT-16 462→465,
  OUT-17 464→467, OUT-18 466→469, OUT-19 333→336, OUT-24 432-433→435-437,
  OUT-27 248-250→250-251). OUT-20's 199-205 was already correct.
• UI-06 selector.go:107→:95, UI-07 session_selector.go:112→:122.
• Preamble rewritten: line numbers are a locator recorded against the pre-merge
  branches, not an assertion; the tree wins when they disagree.
• Statuses corrected to merged main: REQ-23 and OUT-26 → done (the
  ## PR1 closure evidence section already says both are closed, CI runs
  go test -tags=integration ./cmd on both legs, and internal/testenv +
  AssertSandboxed exist); OUT-28 and OUT-29 → done (settled by review,
  matching their sibling SCA-17).

Recomputed summary (before → after)

The old counts were computed against the duplicated table.

	before	after
Total rows	167	188
CONFIRMED	155	175
OVERSTATED	8	9
REFUTED	4	4
test	152	172
test + prod-fix	5	6
prod-fix	1	1
wont-fix	5	6
refuted	4	3
rows requiring work	158	179
rows carrying a production change	6	7

By PR: PR1 2/0, PR2 12→13/11→12, PR3 10/10, PR4 42→43/41,
PR5 42/39, PR6 16/16, PR7 10→11/10→11, PR8 39→47/37→45,
no-PR 4/0→1.

wont-fix gained COV-02 and refuted lost OUT-27 (REFUTED verdict, but a test was
added anyway) — both were miscounted before, independently of the duplication.

Reconciliation narrative

The old narrative no longer held arithmetically, so it was fixed rather than
fudged. The five batch headlines sum to exactly 145 (22+25+35+22+41). The
43-row excess now decomposes exactly:

• +23 rows found after the five audits by adversarial re-review
  (OUT-30..38, SCA-19..24, WF-21..25, SFU-23, COV-01, COV-02). These
  were never accounted for in the old table, which is most of why it did not add
  up; a sixth table row now names them.
• +20 within the batches: 12 are the OVERSTATED/REFUTED rows the headlines
  excluded, 8 are finer enumeration in batches 4 and 5.

Batch 3 and batch 5 rows now state their ID ranges explicitly (SCA-01..18 +
WF-01..20; SFU-01..22 + CACHE-01..07 + CFG-01..09 + UI-01..10) so the
+23 additions cannot be silently folded back in. Batch 5's verdict split was also
wrong ("all CONFIRMED" — SFU-22 is OVERSTATED).

Verification

• No duplicate IDs inside ## Ledger; ## Summary and ## PR1 closure evidence
  untouched by the dedupe (CFG-02's three legitimate ## Summary appearances are
  preserved).
• Every markdown table in the file has a consistent column count (checked
  programmatically, escaped \| handled).
• 20 cited File:line references and 65 named tests spot-checked with rg.
• Docs-only: git diff --name-only origin/main...HEAD → docs/mutation-ledger.md.

done rows whose named test does not exist on main

Two, both from the deletion of ui.SelectGroup in #68, both handled above:
TestSortGroupsForDisplay_Ordering (UI-02, row repointed at existing tests, stays
done) and TestSelectGroup_EmptyList (UI-08, no successor exists — flipped to
todo). The other genuine todo is WF-25, deliberately deferred out of PR8;
Validator.Regex is confirmed unasserted anywhere in internal/workflows.