fix(mutation): order sandbox aliases longest-first so subpaths resolve

Every shard of the mutation sweep aborted in Stryker's dry run with:

  Cannot find package '@agent-device/selectors/engine' imported from
    .tmp/stryker/sandbox-*/src/core/selector-pipeline.ts

The alias was generated correctly; it just never won. Vite matches a STRING
alias by prefix and takes the first hit, and `workspaceSpecifierTargets`
emitted the bare `@agent-device/selectors` ahead of the subpath entries. The
bare entry therefore captured `@agent-device/selectors/engine` and rewrote it
to `…/src/index.ts/engine`, which does not exist; Node fell back to real
package resolution, could not find the subpath inside the sandbox, and the dry
run failed before a single mutant ran — so the shard uploaded an empty
envelope instead of a report and the ratchet failed for want of one.

Sorting longest specifier first makes the most specific alias win:

  @agent-device/selectors/engine -> packages/selectors/src/engine.ts
  @agent-device/selectors/ast    -> packages/selectors/src/ast.ts
  @agent-device/selectors        -> packages/selectors/src/index.ts

`/ast` never tripped this because nothing in a related test set imported it;
`selector-pipeline.ts` introduced the first subpath import that mattered
(#1744), so the mutation lane has been unable to run since that landed. Any
PR touching `scripts/mutation/**` — which fails open into the full sweep —
would have hit it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SkS4S8XXrfkJ8TD1VBKkvJ

Author: claude

vitest.mutation.config.ts

@@ -16,10 +16,17 @@ const repoRoot = path.dirname(fileURLToPath(import.meta.url));
 // which Stryker copies into the sandbox — keeps resolution inside the mutated
 // tree. Entries come from the shared exports-map reader, never a wildcard, so
 // this cannot resolve package internals the boundary forbids (R11).
-const workspaceAliases = [...workspaceSpecifierTargets(repoRoot)].map(([find, target]) => ({
-  find,
-  replacement: path.join(repoRoot, target),
-}));
+// Longest specifier first. Vite matches a STRING alias by prefix and takes the first hit,
+// so a bare `@agent-device/selectors` entry ahead of `@agent-device/selectors/engine`
+// captures the subpath and rewrites it to `…/src/index.ts/engine`. Node then reports
+// `Cannot find package '@agent-device/selectors/engine'` from inside the sandbox, the dry
+// run fails, and every shard aborts before a single mutant runs.
+const workspaceAliases = [...workspaceSpecifierTargets(repoRoot)]
+  .sort(([a], [b]) => b.length - a.length)
+  .map(([find, target]) => ({
+    find,
+    replacement: path.join(repoRoot, target),
+  }));
 
 // Test scope for the decision-kernel mutation lane (issue #1415).
 //