tri mutate census --lab: one lab job for a directory of specs #7471

Problem

tri mutate census --dir D (#7433) runs tri mutate spec once per spec on the machine that calls it. On a Mac worktree that is a local zig build of every mutant, and t27c work belongs on the Railway lab (owner rule, 2026-10-04). Passing --lab after --dir hands it to each run, so a directory of N specs becomes N lab requests in a row: N uploads and N waits, each with its own run directory. #7433 planned one lab run for a directory; that part moved here so #7433 lands the local command first.

Plan

• One lab job per census: upload the directory's .t27 files (and the accepted file) once, run tri mutate census --dir there with the lab's binaries, and read back one stdout and one exit, as tri mutate spec --lab does for one spec (tri mutate spec --lab: run the mutation pass on the Railway lab from a Mac worktree #7050, specs/tri/mutate/lab.t27).
• The lab's own exit codes 3..5 (lab.t27) cover the whole job; 0..2 stay the census's (specs/tri/mutate/census.t27).
• Every rule in t27, reached through t27c gen-rust; the hand-written Rust stays within the Only-t27 gate: a foreign-line budget the label cannot lift; local hook reads exceptions from origin/master #7371 budget (40 lines per file, 80 per pull request).

Acceptance criteria

• tri mutate census --dir specs/queen --lab --accepted F from a Mac worktree prints the same census: lines and exits with the same code as tri mutate census --dir specs/queen --accepted F run on the lab.
• One upload and one run directory on the lab per call.
• Negative control: with the lab unreachable, the command exits 3..5 as tri mutate spec --lab does, never 0.

Boundary

cli/tri/src/mutate.rs
specs/tri/mutate/census.t27
specs/tri/mutate/lab.t27
gen/rust/tri/mutate/

Refs #7433, #7050

User Scenarios

• Given a Mac worktree with a directory of .t27 specs and an accepted file, when the user runs tri mutate census --dir specs/queen --lab --accepted F, then the command prints the same census: lines and exits with the same code as running tri mutate census --dir specs/queen --accepted F directly on the Railway lab.
• Given a directory of N specs, when the user runs tri mutate census --dir with --lab, then exactly one upload and one run directory are created on the lab for the entire census job.
• Given the lab is unreachable, when the user runs tri mutate census --dir with --lab, then the command exits with a code in 3..5 (lab error codes) and never exits 0.

Requirements

FR-001: The tri mutate census --dir command with --lab flag MUST upload the directory's .t27 files and accepted file once to the lab.
FR-002: The lab job MUST execute tri mutate census --dir using the lab's binaries and return a single stdout and exit code.
FR-003: The lab's exit codes 3..5 MUST cover the entire census job; exit codes 0..2 MUST remain the census's own codes.
FR-004: The implementation MUST follow all rules in t27 reached through t27c gen-rust; hand-written Rust MUST stay within the #7371 budget (40 lines per file, 80 per pull request).
FR-005: When the lab is unreachable, the command MUST exit with a code in 3..5, never 0.