build(deps-dev): Bump infection/infection so CI actually exercises webmozart/assert ^2.0

[cancan101]

Follow-up to #354 / #355.

Context

#355 widens the runtime constraint to "webmozart/assert": "^1.11 || ^2.0".
That change is verified against 2.4.1 locally (325/325 tests pass, identical to
1.12.1), but CI never resolves to 2.x, so the newly-allowed upper range
ships untested.

The blocker is the dev requirement:

"infection/infection": "^0.29.14 || ^0.31.0"

The newest release in that range, 0.31.9, requires webmozart/assert: ^1.11,
which holds the whole dev environment at 1.12.1.

This is already mostly solved by #353

Infection widened its own constraint in 0.32.0 — every release from 0.32.0
onward requires webmozart/assert: ^1.11 || ^2.0:

infection	php	webmozart/assert
0.34.1	^8.3	^1.11 || ^2.0
0.33.0	^8.3	^1.11 || ^2.0
0.32.0	^8.2	^1.11 || ^2.0
0.31.9	^8.2	^1.11

(Expanded from the packagist p2 metadata, which uses a forward-diff format
where an omitted key means "unchanged from the previous entry" rather than
"absent".)

#353 is the open dependabot PR bumping the dev constraint to
^0.29.14 || ^0.31.0 || ^0.32.0 — exactly the cutoff needed. So landing #353
is what makes #355 meaningful in CI; the two are order-independent but
complementary.

What to verify when #353 lands

• A default / highest dependency-versions job really installs
  webmozart/assert 2.x. That is the entire point, and it is worth asserting
  rather than assuming. The lowest jobs will correctly keep resolving
  infection 0.29.14 → assert 1.11.0.
• Infection 0.32.0 changed source directory paths to resolve relative to the
  config file rather than the current working directory. This looks like a
  no-op here: infection.json5 sits at the repo root with
  "directories": ["src"], and make infection runs from the root, so config
  dir and cwd coincide. Worth a glance at the run output regardless.
• Mutation-score thresholds may shift if 0.32.0 adds or changes mutators, and
  the existing ignore / ignoreSourceCodeByRegex entries in infection.json5
  should still match after any mutator renames.

Why this is filed separately

Bumping a mutation-testing tool carries its own risk of config and threshold
churn, which shouldn't block the dependency fix in #355. If #353 merges
cleanly, this ticket can simply be closed.