test(domain): mutation baseline 90 (achieved 97.7%) + CI/Makefile wiring (refs #6)

Stryker.NET config for the domain service (break 90, the repo's ratchet floor),
excluding the OpenZaakJobPump hosted-shell from mutation. Hardened the unit tests
to kill survivors — Basic-credential value, variable types, null/failure response
paths, option defaults, guard clauses, save counts and log output — leaving only
two documented equivalent mutants (Stryker-disabled). make mutation runs the domain
ratchet and CI uploads its report alongside the others.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Tests/OpenZaakWorkerTests.cs

@@ -27,6 +27,15 @@ public class OpenZaakWorkerTests
         Assert.Equal("123456782", acl.OpenedForBsn);
         var saved = await store.GetAsync(registration.Id);
         Assert.Equal(FakeAclClient.DefaultZaakUrl, saved!.ZaakUrl);
+        Assert.Equal(1, store.SaveCount);
+    }
+
+    [Fact]
+    public async Task Handling_a_null_job_is_rejected()
+    {
+        var worker = new OpenZaakWorker(new FakeRegistrationStore(), new FakeAclClient());
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => worker.HandleAsync(null!));
     }
 
     [Fact]
@@ -36,8 +45,9 @@ public class OpenZaakWorkerTests
         var acl = new FakeAclClient();
         var worker = new OpenZaakWorker(store, acl);
 
-        await Assert.ThrowsAsync<InvalidOperationException>(
-            () => worker.HandleAsync(new OpenZaakJob("job-1", RegistrationId.New())));
+        var job = new OpenZaakJob("job-1", RegistrationId.New());
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() => worker.HandleAsync(job));
+        Assert.Contains(job.RegistrationId.ToString(), ex.Message);
         Assert.Equal(0, acl.CallCount);
     }