fix(ci): derive oasdiff base-ref from package version + flag mutation-toolchain regression (#4134)

Quality-Gate v2 Fase 9 maintenance (two findings from the Onda 0-1 follow-up):

- check-openapi-breaking.mjs: DEFAULT_BASE_REF was hard-coded "origin/release/
  v3.8.27" and drifted into the v3.8.29 cycle — LOCAL runs of the oasdiff
  breaking-change gate diffed the PR spec against the wrong release (CI passes
  BASE_REF=${{ github.base_ref }} and was unaffected). Derive it from
  package.json via releaseBranchForVersion() so it tracks every release bump
  automatically; literal fallback bumped to v3.8.29. +3 TDD cases.

- docs/ops/MUTATION_GATE_STRYKER_REGRESSION.md: NEW toolchain regression —
  `npx stryker run` now fails at config validation under Stryker 9.6.1 + ajv
  8.18.0 with a false "concurrency must match pattern" (reproduced with the
  UNMODIFIED stryker.conf.json, and with concurrency removed). The project
  config is valid — a standalone ajv 8.18.0 (Stryker's own dep) accepts it — so
  it's an OptionsValidator regression, not our config. This is NOT a re-opening
  of the Task 12 spike (perTest/killedBy was settled GO in v3.8.27; the nightly
  ran as recently as v3.8.28, timing out on budget). The nightly now can't even
  start; clearing this (a dependency pin needing a non-shared reinstall) is the
  prerequisite to producing scores again. Doc records evidence + fix direction.

scripts/check/check-openapi-breaking.mjs

@@ -29,13 +29,14 @@
 // neste repo: report → ratchet → block).
 //
 // Base ref:
-//   • CI passa BASE_REF=${{ github.base_ref }} (ex.: "release/v3.8.27").
-//   • Local: default origin/release/v3.8.27.
+//   • CI passa BASE_REF=${{ github.base_ref }} (ex.: "release/vX.Y.Z").
+//   • Local: default derivado da versão do package.json (releaseBranchForVersion),
+//     ex.: package 3.8.29 → "origin/release/v3.8.29" — nunca fica stale entre ciclos.
 // A spec base é extraída com `git show <BASE_REF>:docs/reference/openapi.yaml`.
 //
 // Uso:
 //   node scripts/check/check-openapi-breaking.mjs
-//   BASE_REF=origin/release/v3.8.27 node scripts/check/check-openapi-breaking.mjs
+//   BASE_REF=origin/release/vX.Y.Z node scripts/check/check-openapi-breaking.mjs
 //   node scripts/check/check-openapi-breaking.mjs --json    # imprime JSON bruto do oasdiff
 //   node scripts/check/check-openapi-breaking.mjs --quiet   # suprime logs de diagnóstico
 //   node scripts/check/check-openapi-breaking.mjs --ratchet # falha (exit 1) numa regressão
@@ -53,7 +54,35 @@ const RATCHET = process.argv.includes("--ratchet");
 
 const SPEC_REL = "docs/reference/openapi.yaml";
 const SPEC_PATH = path.join(ROOT, "docs", "reference", "openapi.yaml");
-const DEFAULT_BASE_REF = "origin/release/v3.8.27";
+
+/**
+ * Deriva o branch base de release a partir de uma versão semver
+ * (ex.: "3.8.29" → "origin/release/v3.8.29"). Mantém o default sincronizado com
+ * o ciclo de release SEM hard-code: o version-bump atualiza package.json a cada
+ * ciclo, então o default nunca fica stale (era "origin/release/v3.8.27" fixo).
+ * Ignora sufixos de prerelease/build (ex.: "3.8.29-dev.2" → v3.8.29).
+ *
+ * @param {string|null|undefined} version
+ * @returns {string|null} branch base (sem `origin/` ausente) ou null se não-semver
+ */
+export function releaseBranchForVersion(version) {
+  const m = String(version ?? "")
+    .trim()
+    .match(/^(\d+)\.(\d+)\.(\d+)/);
+  return m ? `origin/release/v${m[1]}.${m[2]}.${m[3]}` : null;
+}
+
+function readPackageVersion() {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(ROOT, "package.json"), "utf8")).version;
+  } catch {
+    return null;
+  }
+}
+
+// CI sempre passa BASE_REF=${{ github.base_ref }} e vence; este default só vale
+// para runs locais. Derivado da versão para não re-driftar a cada release.
+const DEFAULT_BASE_REF = releaseBranchForVersion(readPackageVersion()) || "origin/release/v3.8.29";
 const BASELINE_PATH = path.join(ROOT, "config/quality/quality-baseline.json");
 
 // ---------------------------------------------------------------------------