test(core): close package mutation gate

Classify only the two non-terminating const-loop mutations after deterministic fingerprint outputs are asserted, then prove the complete hemx-core package mutation-clean through xtask.

req: abi/003

req: test/020

req: test/021

req: test/022

.cargo/mutants.toml

@@ -3,10 +3,14 @@
 # - test_process_poll_delay: poll cadence is operational; readiness and timeout are integration-proven.
 # - Drop for TestProcess: mutating reaping leaks helper processes beyond the test lifecycle.
 # - inspection_fingerprint: deliberately unobservable test-harness metadata.
+# - BuildFingerprint::from_parts loop-progress mutations: syntactically valid but
+#   non-terminating const-loop mutants; deterministic hash outputs are asserted.
 exclude_re = [
   "test_process_try_wait",
   "test_process_poll_delay",
   "delete statement std::thread::sleep\\(Duration::from_millis\\(25\\)\\)",
   "<impl Drop for TestProcess>::drop",
   "inspection_fingerprint",
+  "replace \\+= with \\*= in BuildFingerprint::from_parts",
+  "replace 1 with 0 in BuildFingerprint::from_parts",
 ]

PLAN.md

@@ -18,10 +18,10 @@
 
 ## 2. Make mutation testing a reproducible release gate
 
-- [ ] **State:** In progress — the package-native capped xtask entry point is reachable, rejects unknown packages, propagates mutest failure, and mutation-tests `hemx-js` and the full `hemx-test` package cleanly; full package closure remains.
+- [ ] **State:** In progress — the package-native capped xtask entry point is reachable, rejects unknown packages, propagates mutest failure, and mutation-tests `hemx-core`, `hemx-js`, and the full `hemx-test` package cleanly; full package closure remains.
 - **User value:** maintainers can run one bounded repository command and trust that meaningful Rust logic across every mutation-applicable library is either killed or explicitly justified.
 - **Build:** add a capped `hemx-xtask` mutation command that invokes `/opt/repositories/mutest`/`mutest` through package-native test targets rather than the broken workspace-wide example path; enumerate only current mutation-applicable library/proc-macro packages; finish adversarial tests or simplify code until every survivor is classified; keep equivalent, invariant-only, and infrastructure-inapplicable classifications inspectable and minimal; document the exact local release command in the existing readiness surface.
-- **Blocked by:** none; broad survivors currently remain in `hemx-axum`, `hemx-build`, `hemx-core`, `hemx-derive`, and `hemx-lsp` outside already-clean focused contracts.
+- **Blocked by:** none; broad survivors currently remain in `hemx-axum`, `hemx-build`, `hemx-derive`, and `hemx-lsp` outside already-clean focused contracts.
 - **Proof:** the new xtask mutation command exits zero within its documented bound, covers each applicable package, emits no unexplained missed mutant, and a deliberate adjacent mutation makes it fail. `cargo run -p hemx-xtask -- test` remains green. req: test/020 req: test/021
 
 ## 3. Elect and enforce the release license policy