ci: quality gates hardening for control plane and mutation testing (#107)

[vxfemboy]

Closes #107 (Note: WAN benchmark regression gate deferred to #109).

Summary

1. Control-Plane Coverage Hardening ():

   • Removed --exclude yipd to enforce the workspace 90% line coverage gate on yipd control plane logic (peer_manager/*, epoch, membership, config, mac_table, flow).
   • Added regex exclusions (--ignore-filename-regex '.*/(uring|rs_simd|tunnel|main|sharding)\.rs$') for modules requiring Linux root privileges / raw socket / TUN device access that cannot execute in unprivileged CI containers.
   • Measured workspace line coverage is 91.48% (regions: 90.96%), satisfying --fail-under-lines 90.

2. Expanded Mutation Testing & Durable Artifacts ():

   • Expanded target packages to cover yip-obf, yip-membership, and yip-rendezvous alongside yip-wire, yip-transport, and yip-crypto.
   • Added actions/upload-artifact@v4 with if: always() and a 14-day retention period on mutants.out/ so surviving mutant logs are preserved for triage.