test: tri mutate spec --lab's railway ssh call has no test #7390

What is missing

tri mutate spec --lab (#7366, merged as 694b418) has two ways to reach the lab: sh -c when T27C_LAB_LOCAL=1, and railway ssh -p P -e ENV -s SVC <script> otherwise. Every test in cli/tri/src/mutate.rs drives the sh -c branch. The only test with local: false points at a missing railway binary and checks the error. So the argument list of the real call has no test: dropping ssh or -p PROJECT from it would pass cargo test.

The #7050 comment and the #7366 body said this branch was covered by the scripted tests. That was wrong, and both texts now say so.

Done when

• A test runs a whole lab run (probe, upload, launch, read-back, removal) through a stand-in railway that records its arguments and runs the script it got, and checks every call reads ssh -p p1 -e production -s t27c-lab.
• Dropping c.arg("ssh"), or the -p pair, from lab_call_once fails that test.
• cargo test --release -p tri mutate:: passes on the Railway lab, 0 warnings in mutate.rs.

Not in scope: a live run through the real railway CLI from a Mac. That stays open on #7050.

Refs #7050.