test(domain): mutation baseline 90 (achieved 97.7%) + CI/Makefile wiring (refs #6)

Stryker.NET config for the domain service (break 90, the repo's ratchet floor),
excluding the OpenZaakJobPump hosted-shell from mutation. Hardened the unit tests
to kill survivors — Basic-credential value, variable types, null/failure response
paths, option defaults, guard clauses, save counts and log output — leaving only
two documented equivalent mutants (Stryker-disabled). make mutation runs the domain
ratchet and CI uploads its report alongside the others.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Tests/OpenZaakJobProcessorTests.cs

@@ -1,6 +1,7 @@
 using Big.Application;
 using Big.Domain;
 using Big.Infrastructure;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
 
 namespace Big.Tests;
@@ -54,11 +55,16 @@ public class OpenZaakJobProcessorTests
         var acl = new FakeAclClient();
         // The job correlates to a registration that is not in the store, so the worker throws.
         var client = new FakeExternalWorkerClient(new OpenZaakJob("job-1", RegistrationId.New()));
+        var logger = new CapturingLogger<OpenZaakJobProcessor>();
+        var processor = new OpenZaakJobProcessor(client, new OpenZaakWorker(store, acl), logger);
 
-        var acquired = await Processor(client, store, acl).PumpOnceAsync(5);
+        var acquired = await processor.PumpOnceAsync(5);
 
         Assert.Equal(1, acquired);
         Assert.Empty(client.Completed);
+        // The failure is logged (and the job left for redelivery), not swallowed silently.
+        var error = Assert.Single(logger.Entries, e => e.Level == LogLevel.Error);
+        Assert.Contains("job-1", error.Message);
     }
 
     [Fact]