ci: fail-closed guard against left-over mutation mutants

[b7n0de]

Why

On 2026-07-23 a mutation probe's if False: at the SD-JWT key-binding check in bundle.py survived into the working tree (plus a stray .mutbak backup); only a manual diff-before-commit caught it before commit. try/finally restore cannot survive a hard kill (SIGKILL skips finally), so the fix has to be structural, not procedural.

What (three mechanical layers)

1. mutation_check.py v1.4, tempdir isolation: mutants are applied in a throwaway copy of the tracked tree (git ls-files → tempdir); the real working tree is never written to, so even SIGKILL mid-probe cannot leave a mutant or backup litter behind. The .mutbak mechanism is gone (in-memory restore inside the copy). Differential-baseline semantics unchanged. The run additionally compares git status --porcelain before/after and fails closed on any left-over working tree change.
2. CI clean-assert: the mutation job ends with an always-run step that fails if git status --porcelain is non-empty, the machine version of the manual diff that caught the incident.
3. mutant_signature_guard.py: a narrow, explainable diff guard over added lines on src/proofbundle/**, wired as a pre-commit hook (scripts/install_git_hooks.sh) AND a new blocking CI job, so skipping the hook locally does not skip the check. Classes: (A) trivial-truth branches (if/elif False|True, while False) at a check, (B) commented-out verification lines (verify-call prefilter, then the comment content must PARSE as a Python statement, so prose stays quiet), (C) return True opening a verify/validate/check function. Legitimate exceptions need a visible # mutant-guard: allow comment in the diff.

Evidence

• --self-test (runs first in the CI job): 11/11, five signature classes caught, six negative controls quiet, including the three real false-positive prose shapes found while scanning the full v3.6.0..HEAD history (pinned as fixtures after narrowing class B).
• Full-history negative control: guard is quiet over v3.6.0..HEAD.
• Incident replay: staging the exact if False: at bundle.py:425 is blocked by the installed pre-commit hook (exit 1, no commit created).
• SIGKILL mid-probe on the real repo: git status --porcelain before/after byte-identical, zero .mutbak.
• Isolated end-to-end on the real repo: baseline red 0, operator "bundle: KB check unwired" KILLED, the documented-equivalent survivor SURVIVED, both as expected.
• 17 new unittest cases (staged + base modes, isolation contract, leftover fail-closed), ruff clean.

No changelog entry: ci: prefix is documented-trivial in check_version_and_changelog.py. No release, no tag, no PyPI.