Expression-level mutant generation for selector hosts and integrations.

A region that macro routing declared raw — a :hosted DSL fragment owned by its Mutare.Mutator.MacroHost, or a :raw argument owned by the mutator that registered the macro — is never descended by core. But such a region can contain islands of ordinary Elixir that are exactly core's business: everything under an Ecto ^ pin is evaluated at runtime and interpolated as a query parameter, so ^18 or ^(min + 1) deserves core's value mutations under the user's configured families — not a DSL-semantics catalog, and not nothing.

expression_mutations/3 is the sub-contract seam: it generates the logical single-point mutants of an expression subtree exactly as core's analyzer would for the same code outside a DSL, and returns them as data. Generation is core's; delivery stays the caller's — on either delivery path a raw region can take:

• a selector host (Mutare.Mutator.MacroHost.host/2) wraps each rebuilt subtree back under its pin, appends it to its Mutare.Mutator.MacroHost.Target mutants (tagged with the producing spec via Mutare.Mutator.Mutation's :producer), and the ordinary hosted pipeline assigns ids, records sites under the producing family, and weaves the host's selector;
• a mutator offered the whole call of a registered macro (Mutare.Mutator.mutate/2 — the free-standing dynamic/1,2 shape, where the macro sits in ordinary expression position and its :raw argument stays as written) rebuilds the call around each mutant and relays it the same way; delivery is the ordinary in-place selector.

On both paths the run's enabled specs arrive as context.mutators — the full set, selector hosts included — so the interior is analyzed exactly like top-level Elixir under the user's actual configuration (:as renames and per-instance options included — and with a family disabled, its interior mutants simply don't exist). A host-implementing mutator participates through both of its surfaces: its ordinary node-level mutate/1,2 (a registered macro inside the island is offered whole-call to its owner — the inner-dynamic case), and its hosted surface, whose targets are lowered to whole-call rebuilds (splice(wrap(mutant)) — the woven selector degenerated to its selected branch) rather than woven, so hosted delivery never nests while no mutant is lost:

defp pin_mutants({:^, meta, [inner]}, context) do
  for {spec, mutated, note, variant} <-
        Mutare.Analyze.expression_mutations(inner, context.mutators, context) do
    Mutare.Mutator.Mutation.new({:^, meta, [mutated]},
      producer: spec,
      note: note,
      variant: variant
    )
  end
end