fix: tighten unsafe mutator dispatch

[berisher]

Summary

• enforce unsafe-only mutator policy at selection time, CLI parsing time, and mutation dispatch time
• replay post-emission rewrites through normal stack simulation and discard rewrites that cannot be synchronized
• make type-confusion replacements protocol-aware and limit them to pure push opcodes

Remediated Hunter findings

• F-0039 Post-emission rewrites bypass stack and memo re-simulation
• F-0082 Mutator::is_unsafe() was defined but not enforced by generator dispatch
• F-0085 MemoIndexMutator::is_unsafe() claimed safe-mode behavior that can still create invalid memo references
• F-0086 OffByOneMutator mutated memo indices despite the safe-mode contract
• F-0087 TypeConfusionMutator emitted replacements without checking protocol support
• F-0088 TypeConfusionMutator silently degraded into a no-op without unsafe_mode
• F-0089 TypeConfusionMutator rewrote stack-consuming constructors as if they were pure pushes

Changes

• add MutatorKind::requires_unsafe_mutations() and reject memoindex / typeconfusion on the CLI unless --unsafe-mutations is present
• exclude unsafe-only mutators from all unless unsafe mutations are enabled
• add replay metadata for post-processed emissions and use it to resimulate rewritten opcodes from the pre-emission state
• discard post-processing rewrites that cannot describe a valid replacement opcode
• mark MemoIndexMutator as unsafe in all modes and stop OffByOneMutator from touching memo indices
• rebuild TypeConfusionMutator as an unsafe-only mutator with protocol-aware replacement encoding, pure-push opcode matching, and replayable replacement descriptions
• document the unsafe-only mutator requirement in README.md

How to validate

• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• cargo test