[zonuexe]

Summary

• Add Infection through the Composer bin plugin with an isolated dependency lockfile.
• Expand routing tests to reach 100% covered mutation score and remove an unreachable Router branch.
• Pin CI actions, restrict workflow permissions, and keep locked dependencies compatible with PHP 8.3.

Verification

• composer validate --strict
• composer test -- --no-coverage — 103 tests, 258 assertions
• PHPStan, ECS, PHP syntax checks
• composer infection — 315 mutants, 100% mutation coverage, 100% covered-code MSI
• Root and Infection Composer install dry-runs
• Public API smoke test