Add tests to kill cargo-mutants survivors (72% → 100%)

[sweis]

Summary

Implements all recommendations from notes/cargo-mutants-analysis.md (PR #34). Adds 63 new unit tests and removes one dead function, raising the mutation score from 72.2% to 100% of fast-testable mutants.

Results

Metric	Before	After
Fast unit tests	95	158
Total unit tests	125	188
Mutants caught	203	264
Mutants missed	78	0
Mutation score	72.2%	100%

Verified with cargo mutants -j 2 in 8 minutes.

Changes by file

Deleted

• Algorithm::signature_len() — dead code, never called anywhere

types.rs (+10 tests)

• Algorithm::from_byte / to_byte exhaustive roundtrip (all 5 variants incl. Groth16)
• KeyIdType::from_byte / to_byte exhaustive roundtrip
• KeyIdentifier::key_id_type() all variants
• is_zero(): JSON serialization omits zero not_before/issued_at; includes nonzero
• Claims::validate duplicate-scope rejection

proto3.rs (+5 tests)

• 10-byte varint overflow (final byte > 1 must reject, = 1 is u64::MAX)
• Zero varint at nonzero offset (pos - start arithmetic)
• Non-minimal varint at nonzero offset
• to_u8 / read_u32 boundary rejection

serialize.rs (+18 tests)

• Oversized payload/token/signature/proof rejection with specific error message pinning (so > → == mutants don't slip through to downstream parse errors)
• Exact-boundary acceptance: MAX_PAYLOAD_BYTES, MAX_SIGNATURE_BYTES, MAX_PROOF_BYTES, 255-byte subject/audience/scope
• MAX_SIGNED_TOKEN_BYTES pinned to 6944 (catches arithmetic mutations)
• Proof field (field 3) serialization roundtrip
• FullKeyHash payload roundtrip + wrong-length rejection
• Duplicate non-scope field rejection

keys.rs (+12 tests)

• validate_public_key_size: wrong-length Ed25519 (31 B) and ML-DSA-44 (1000 B) keys
• Groth16 algorithms rejected in VerifyingKey and extract_verifying_key with specific message pinning
• Oversized secret_key / public_key DoS limits + boundary acceptance
• Groth16 signing key serialization roundtrip + short-key rejection

sign.rs (+13 tests)

• generate_hmac_key(): length is 32, two keys differ, not all-zeros
• compute_full_key_hash / compute_sha256_full_key_hash: deterministic, different inputs → different outputs, known SHA-256 value for zero bytes
• Claims::validate boundary via sign_hmac: overlong subject/audience/scope, too many scopes, exact-limit acceptance, not_before == expires_at
• mldsa44_key_hash wrong-length rejection

verify.rs (+3 tests)

• verify_key_match specifically returns KeyHashMismatch (was shadowed by signature check in all existing tests)
• Ed25519 key hash mismatch returns KeyHashMismatch

poseidon.rs (+2 tests)

• bytes_to_fr known values (little-endian 1 == Fr(1), zero == Fr(0))
• poseidon_config parameters pinned (8/57/5/2/1)

.cargo/mutants.toml

• Exclude sign_groth16/verify_groth16 function body replacements (12 mutants). These need ~2min SNARK trusted setup per test, covered by make test-snark. All their constituent helpers have fast unit tests.

Key test patterns

• Error-message pinning: matches!(err, MalformedEncoding(m) if m.contains("specific message")) — ensures error-shadowing mutants (which reach a different error path) are caught.
• Boundary pairs: every size-limit check has both an "oversized → rejects with specific error" test and an "exactly-at-limit → passes the size check" test, killing > → >= → == mutation cycles.
• Known-value tests: hash functions pin specific input → specific output so constant-return mutants fail.
• Test name hygiene: Groth16-adjacent tests use names like zk_symmetric instead of snark/groth16 so they run under the --skip snark --skip groth16 filters used during mutation testing.