test(domain): mutation baseline 90 (achieved 97.7%) + CI/Makefile wiring (refs #6)

Stryker.NET config for the domain service (break 90, the repo's ratchet floor),
excluding the OpenZaakJobPump hosted-shell from mutation. Hardened the unit tests
to kill survivors — Basic-credential value, variable types, null/failure response
paths, option defaults, guard clauses, save counts and log output — leaving only
two documented equivalent mutants (Stryker-disabled). make mutation runs the domain
ratchet and CI uploads its report alongside the others.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Tests/AclHttpClientTests.cs

@@ -38,6 +38,7 @@ public class AclHttpClientTests
         var capture = new RequestCapture();
         var client = Client(capture.Responds(HttpStatusCode.OK, "null"));
 
-        await Assert.ThrowsAsync<InvalidOperationException>(() => client.OpenZaakAsync("123456782"));
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() => client.OpenZaakAsync("123456782"));
+        Assert.Contains("empty", ex.Message, StringComparison.OrdinalIgnoreCase);
     }
 }