test(build): close app input collection mutants

Traverse inputs once, preserve deterministic HE/ML-before-stylesheet lowering, and prove nested discovery, explicit surfaces, OUT_DIR fallback, missing inputs, invalid UTF-8, permission failures, output failures, and stable collision ordering through AppBuilder::run.

req: build/003

req: build/004

req: build/009

req: diagnostics/004

req: test/021

.cargo/mutants.toml

@@ -10,6 +10,9 @@
 #   are behaviorally equivalent at these validated boundaries.
 # - hemx-build source inspection delegates to hemplate's currently infallible
 #   Surface parser; file I/O and invalid Rust-context errors remain explicitly proven.
+# - AppBuilder reuses that same parser seam. Directory-open and recursive errors are
+#   proven, while a per-entry readdir fault cannot be injected portably after a
+#   successful read_dir; its unwrap mutant is classified as infrastructure-only.
 # - write_if_changed propagates non-NotFound read errors; for ordinary filesystem
 #   paths, attempting the same write returns the same OS error, so the guard mutant
 #   is externally equivalent while create/update/no-op behavior is mutation-proven.
@@ -28,5 +31,7 @@ exclude_re = [
   "replace surface_for_heml_source.* with surface_for_heml_source.*unwrap\\(\\) in diagnostics_for_heml_source",
   "replace surface_for_heml_source.* with surface_for_heml_source.*unwrap\\(\\) in generated_targets_for_heml_source",
   "replace surface_for_heml_source.* with surface_for_heml_source.*unwrap\\(\\) in template_context_facts_for_heml_source",
+  "replace surface_for_heml_source.* with surface_for_heml_source.*unwrap\\(\\) in AppBuilder::run",
+  "replace entry\\? with entry.unwrap\\(\\) in collect_input_files_into",
   "replace match guard error.kind\\(\\) == io::ErrorKind::NotFound with true in write_if_changed",
 ]