Documentation audit, and publish the mutation score as a badge

[loevgaard]

Two commits: a documentation audit, and the mutation-score badge.

Mutation testing in CI — already there

Worth saying up front: the mutation-tests job already existed and has been running composer infection on PHP 8.3 with pcov in every build, gates included (minMsi 65 / minCoveredMsi 70). What
was missing was anywhere to see the result.

So this wires the Stryker dashboard logger in infection.json.dist, passes through the
STRYKER_DASHBOARD_API_KEY secret the repository already has, and adds the badge to the README next to
coverage.

The upload is branch-gated to 2.x: pull request runs still compute the score and enforce the
gates, but publish nothing, so a PR cannot move the badge before it is merged. Locally, Infection
detects it is not in CI and skips the upload — verified:

Mutation Score Indicator (MSI): 82%
Covered Code MSI: 83%
[warning] Dashboard report has not been sent: The current process is not executed in a CI build

The badge will read "unknown" until this merges and the 2.x push build performs the first upload.

Documentation audit

Checked README, CLAUDE.md and docs/UPGRADE-2.0.md against what the code now does. Four things had
gone stale:

• CLAUDE.md described every action as implementing GenericTokenFactoryAwareInterface. Since Drop the unused token-factory wiring from CaptureAction #50
  only AuthorizeAction does — and that is the package's one remaining contact with payum/core's
  deprecated GenericTokenFactoryInterface, so it is worth saying so it stays that way.
• The e2e section still claimed RefundAction refunds details['amount'] and that "the gateway has no
  partial-refund parameter of its own". Both untrue since Surface the payment balance, add a SyncAction, and refund what is actually refundable #48. Replaced with what the harness actually
  encodes now — the listener resolving account-wide callbacks by order_id.
• The README's details table credited balance to GetStatus, Sync and Notify, but Refund also
  refreshes it on its default path.
• CLAUDE.md still described the alias map as covering two required options. It covers three, and the
  third (agreement) is optional — the one that fails silently if missed.

Also records why Action/Api/ApiAwareTrait exists rather than payum/core's (it types $api as Api
where payum/core's is mixed, which is what lets PHPStan see through the most-used dependency in the
package), since that is the question the file should answer before someone deletes it as duplication.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.43%. Comparing base (921a618) to head (a6d30bd).

Additional details and impacted files

@@            Coverage Diff            @@
##                2.x      #53   +/-   ##
=========================================
  Coverage     97.43%   97.43%           
  Complexity      126      126           
=========================================
  Files            14       14           
  Lines           351      351           
=========================================
  Hits            342      342           
  Misses            9        9           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.