Tests that bite, round 2: test-bites in CI, property and mutation tests #4154

Follow-up to #3527. That issue's "highest gain first" items shipped as scripts/test-bites.ts: it runs changed test files on the base's source (toothless = they pass there too), and --lines lists the changed lines they never ran. These are the "Later" items from it, still not built:

• Run test-bites in CI, report only. A step in apps.yml that prints the toothless files and unrun lines for the PR without failing it. A refactor's tests are toothless on purpose, so it can't be a gate. First check what it costs: it runs each changed test file once more, on the base.
• Property tests with fast-check (works under bun:test) for the pure engines: codeSplitter's line splitting, range parsing, merge and conflict handling. One property ("split then join returns the input") replaces dozens of examples.
• Mutation testing on changed files only. Stryker has no Bun runner (its command runner works but is slow), so either scope it to the diff or write our own: flip operators on changed lines (test-bites.ts already has the changed lines and the run-on-a-copy code) and see whether any test notices.
• Contract tests from apps/codesplitter/src/openapi.ts: generated request/response checks, so an endpoint can't drift from its spec.
• Record/replay for model calls: cassettes make agent-path tests deterministic and free, so they can run on every PR.
• Stricter types as free tests: noUncheckedIndexedAccess and exactOptionalPropertyTypes one app at a time, plus knip for dead exports.

Not worth it (from #3527): snapshot tests over AI output, a coverage-percentage gate, a Playwright suite per app.