test: coverage campaign and mutation testing across five packages (#628)

Coverage 83.6 to 87.36% lines, 81.63 to 84.14% branches. Mutation testing across five packages: image-engine 85, media-engine 92, doc-engine 87, shared+enterprise 86, apps/api security and jobs slice. Runs all five lanes weekly. Fixes the silently-broken mutation CI (babel pin), a redact-pdf envelope-shape test bug, an untested enterprise license valid-signature path, and an audit test that only exercised a hand-copied reproduction. Test and config only, no product code changes beyond the babel pin and one test-only oidc export. Full suite: 16,712 pass, 0 fail.

packages/ai/python/.coveragerc

@@ -0,0 +1,13 @@
+# Branch-coverage config for the Python sidecar test lane. `source` is the set
+# of pure/protocol modules with durable direct tests; extend it as the lane
+# grows. Heavy model-runtime modules stay out of this gate and are proven in
+# the real-runtime Docker lane instead.
+[run]
+branch = True
+source =
+    offline_guard
+    progress_heartbeat
+
+[report]
+show_missing = True
+fail_under = 80