scripts: refuse a mutation artifact left in the tree

A mutation-test marker found here had replaced the height in the signed vote
message with a constant, making a signature valid at any height. It sat
uncommitted in a tracked file, where any staging of modified files would have
carried it into a published repository. Restoring the original is the injector's
job; this makes forgetting it visible instead of silent.

Matched without \b, which BSD grep -E ignores — the first version of this rule
matched nothing and reported clean, which is worse than having no rule. Proven
both ways against a marker placed in a tracked file.

Co-authored-by: Hanzo Dev <[email protected]>

scripts/check_source_prose.sh

@@ -40,6 +40,14 @@ report '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' \
 report '\b(ghcr\.io/[a-z]+/[a-z-]+:v?[0-9]+\.[0-9]+\.[0-9]+)' \
   'pinned image references — these belong in manifests, not source'
 
+# A mutation left in the tree is not a style problem. One found in this repo replaced
+# the height in the signed vote message with a constant — signatures valid at any
+# height — and it sat uncommitted where any `git add -u` would have swept it into a
+# public consensus repo. Whoever injects one is responsible for restoring it; this
+# refuses to let the tree be committed while one is still there.
+report '(//|/\*).*MUTAT(ION|ED) *:' \
+  'mutation-test artifacts — restore the original before committing'
+
 if [ "$fail" -ne 0 ]; then
   cat <<'EOF'