chore: add Infection mutation testing

[erikfrerejean]

Adds Infection mutation testing to the module, mirroring the silverstripe-grid setup: task mutate runs infection/infection over src/ against the PHPUnit suite, gated on minMsi in .docker/app/infection.json5. Local-only — deliberately not wired into CI, same as grid.

Measured result

99% covered MSI, 100% mutation code coverage, stable across three consecutive runs. minMsi / minCoveredMsi pinned at 98 — a whole number below the achieved score, so the single documented equivalent survivor cannot red-line the build.

143 mutations generated: 128 killed, 14 ignored, 1 escaped
Mutation Code Coverage: 100%   Covered Code MSI: 99%

PHPUnit config had to be modernised first

Infection rewrites phpunit.xml.dist and validates it against the PHPUnit 11 XSD, which rejects cacheResultFile and <coverage><include>. Both still ran fine under PHPUnit 11 but blocked the tool outright, so they move to cacheDirectory and <source><include> — the forms silverstripe-grid already uses.

Coverage gaps this surfaced

Calibration turned up real holes rather than just noise:

• Permission delegation was never asserted. No test passed an explicit $member to canCreate / canView / canEdit / canDelete, so the very thing those overrides exist for went unverified on both models. Now covered in both directions: an explicit privileged member grants access to an unprivileged session, and an explicit unprivileged member is refused while an admin holds the session.
• getLink() had no coverage for an unrecognised LinkType (a legacy or empty column value) falling through to null instead of an unhandled match error.
• LinkingMode() had no coverage for a non-page item carrying a stale LinkedPageID — it must report link, not current, or an item switched from page to url lights up as active on the old page.

Suppression policy

Every suppression carries an inline proof, and the config documents the triage order: delete dead code → assert the behaviour → only then suppress at the narrowest scope.

The $member ?? 0 IncrementInteger mutants are suppressed with reasoning: the 0 is a type-narrowing device, not behaviour (Permission::checkMember() maps any falsy first argument to the current user, but its declared @param is int|Member, which PHPStan max requires). The mutated ?? 1 resolves member ID 1 instead, and killing it would mean asserting on whichever member owns that auto-increment ID — InnoDB does not roll the counter back with SapphireTest's per-test transaction, so it drifts with execution order. These were observed flipping killed/escaped between identical runs. Their Coalesce twins are deliberately left exposed and are killed by the new delegation tests.

One deliberate survivor is documented rather than suppressed: Menu::IsProtected()'s LogicalAnd, which is only distinguishable by putting '' into protected_menus.

Also

Test metadata moved from @dataProvider docblocks to #[DataProvider] attributes, clearing all PHPUnit 11 deprecation notices (the docblock form is removed in PHPUnit 12).

No production code changed.

Verification

• task mutate → exit 0, 99% MSI with the gate active
• task test → 61 tests, 86 assertions, no deprecations
• task analyse → no errors