ci: raise minimum mutation score to 90 and condense changelog entries

The suite kills 185 of 198 mutants (93% covered MSI); the 13 survivors
are equivalent or contrived. The bootstrap threshold of 68 no longer
defends anything; 90 keeps headroom for run-to-run variance. The
Unreleased changelog entries from the mutation-testing rollout are
condensed to the final outcome, matching the tone of earlier releases.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: turegjorup

CHANGELOG.md

@@ -15,18 +15,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Strengthened constructor tests guided by mutation testing: the `jwt`
-  collaborator is asserted to become the request factory, and `0` is
-  asserted to be an accepted boundary value for `cacheDuration` and
-  `leeway`
-- Strengthened cache assertions guided by mutation testing: the discovery
-  document and JWKS key map are asserted to be written to the cache with
-  the configured duration under the namespaced key, and a multi-key JWKS
-  is asserted to reach `JWT::decode` in full
-- Strengthened exception assertions guided by mutation testing: thrown
-  messages are asserted in full (including dynamic parts), wrap-boundary
-  exceptions assert code `0` and the chained `$previous` cause, and
-  invalid JSON from the token endpoint is covered
+- Strengthened tests guided by mutation testing; mutation score raised to
+  93% with a CI threshold of 90 (`minCoveredMsi` in `infection.json5`)
 
 ## [5.0.0] - 2026-06-02
 

infection.json5

@@ -5,8 +5,11 @@
     },
     "threads": "max",
     // Minimum mutation score for covered code; enforced locally and in CI.
-    // Baseline measured at 71% — ratchet up as surviving mutants are killed.
-    "minCoveredMsi": 68,
+    // The suite scores 93%; the 13 surviving mutants are equivalent or
+    // contrived (JSON depth literals, RNG default lengths, casts only
+    // observable on corrupted cache). 90 defends the score with headroom
+    // for run-to-run variance.
+    "minCoveredMsi": 90,
     "logs": {
         "text": "infection.log",
         "html": "infection.html",