feat(materials): add PITEST_XML material type

[migmartri]

Adds PITEST_XML as a first-class attestable material kind for PIT mutation-testing reports (mutations.xml).

• Validates PIT's native XML via a shared materials/pitest model that pins the <mutations> root and rejects reports with no mutation records.
• Supports contract-free auto-detection (PITEST_XML joins the validation order) without shadowing JaCoCo, Cobertura, or JUnit.
• Projects the XML to JSON ({ "partial": bool, "mutations": [...] }) for policy evaluation, preserving each mutation's status verbatim so policies distinguish SURVIVED from NO_COVERAGE, and keeping both standard and fullMutationMatrix report shapes.

Closes#3373

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri

[chainloop-platform]

Security Checks — ✅ 3 passing

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

PR info

Status	Policy	Messages
✅ Passed	pr-description-required	-
✅ Passed	pr-user-story-linked	-

⏭️ 2 scans not applied

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

View attestation ↗

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 31 files

Not reviewed (too large): pkg/attestation/crafter/api/attestation/v1/testdata/pitest.xml (~167 lines), pkg/attestation/crafter/materials/testdata/pitest.xml (~167 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

_{Re-trigger cubic}

[cubic-dev-ai]

No issues found across 31 files

Not reviewed (too large): pkg/attestation/crafter/materials/testdata/pitest.xml (~167 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

_{Re-trigger cubic}