test(dng): close the crate's first mutation survey

[justin13888]

Refs #110.

gamut-dng's first mutation survey: 1796 caught, 23 survivors, 3 timeouts. All 23 are closed
here — 20 by test, 1 by rewriting an equivalent mutant out of existence, and 2 by exclusions that
carry their proof.

One shape accounts for most of them: a rejection path with no file that reaches it

The crate validates carefully and the happy paths are well covered, so nearly every survivor sits
on the refusal side of a guard.

guard	what the mutant admitted
WhiteLevel count is spp or 1	every wrong count, silently broadcasting v[0]
BlackLevelRepeatDim has 2 values	any other count, reading the first two and ignoring the rest
repeat rows/cols > 0	a zero dimension, giving a cell count of nothing
floats is non-empty	an empty FLOAT array
BlackLevelDeltaV length and finiteness	a delta failing one condition but not both

Two of those needed two fixtures rather than one, and that is the part worth stating:
white_level_value refuses a level that is fractional or past u32::MAX, and a value tripping
one disjunct does not trip the other — 100.5 kills the ||→&& mutant, u32::MAX + 1 kills the
>→== mutant, and neither closes both. Same for BlackLevelDeltaV.

Boundaries where both answers are legal

black_level_value and white_level_value pick SHORT or LONG by width, and every DNG reader
accepts either — so nothing but the file's length records which was chosen. Both boundaries are now
pinned at the two straddling values, the same blind spot gamut-tiff's dim_value had.

The RATIONAL grid's bound is sharper than it looks: a fractional level is stored as (v * 65536).round() / 65536, so exactly 65536 needs a numerator of 2³² — one past u32::MAX, where
the as u32 cast wraps. The bound has to be exclusive. Reaching that arm also needs a mixed
slice, since 65536 alone is integral and is taken by the LONG arm above.

A compatibility path that only a comment vouched for

The decoder falls back to IFD 0 when the raw IFD carries no NoiseProfile — "some writers put it
there instead" — guarded by raw_index != 0. Every fixture put the tag where the spec says, so
inverting that guard disabled the fallback in exactly the case it exists for, and left it firing
only where it is a no-op. These are the easiest gaps to leave open, because the code reads as
though the comment were the evidence.

The archival verdict, again

DeconstructReport::is_fully_classified survived replacement by true. Unlike gamut-tiff's copy
of this defect the wrapper is called here — but every call expects true, so the suite
pinned that clean files are clean and never that a broken one is not.

The fixture transferred from gamut-tiff, including the negative result: trailing junk does not
work, because the walk classifies it as a trailer (and trailing_junk_is_classified_as_a_trailer
already relies on that). A strip declared past EOF is out_of_bounds, one of the five conditions
the verdict is built from.

MD5, and one fix made ahead of the survey

RFC 1321 prints F as (b & c) | (!b & d), whose halves are disjoint by construction, so | and
^ agree on every input. Both F and G are now their standard XOR forms. Only F was reported;
G has identical structure, and a later shard duly reported it — fixing the pair on sight is the
point of recognising the shape. This is the twelfth instance of disjoint-lane | in the workspace
and the fifth crate.

A hash is the last place to trust "obviously equivalent" algebra, so this leans on the RFC 1321
vectors already in the module rather than on that argument: they pass unchanged, and the operator
mutations of the new forms are each confirmed caught.

Two exclusions, both optimisations rather than behaviour

• x_factor's Predictor::None arm. validate returns early for that predictor above its
  x_factor(...).is_none() check, and the other call site filters f > 0, where Some(0) and
  None take the same path. The arm stays rather than being deleted: it keeps the match total, and
  if that early return ever moved, _ => None would misreport the ordinary no-predictor case as a
  floating-point one.
• undo's channels == 0 || group_cols < 2 early return, and lossless JPEG's pt > 0 skip. In
  both, the guarded work is already a no-op — an empty channels..row_step range, and <<= 0
  respectively — so the mutant does strictly more work for byte-identical output.

Validation

cargo test -p gamut-dng --all-features clean, mise run fmt-check, mise run check-tests and
clippy clean. Every mutant was applied by hand and confirmed caught. That caught a flaw in one
of my own tests: the repeat-dim fixture used [1, 0], which exercises only the column guard, and
the row mutant survived — rows and columns are filtered separately, so one zero cannot stand in for
the other. Both orientations are asserted now.

Note on completeness

Four shards (7, 8, 11, 12) were truncated — one by the filesystem hitting 100%, three by a
per-shard timeout that was too tight for this crate under load. They are queued for re-run, so 23
is a floor. Any further survivors will follow in a separate PR rather than holding this one.