test(r2): commit the round's falsifiers as a mutation table; one flag predicate

tests/mutations/r2_flow.toml: 18 falsifiers, each proved RED under its
change by scripts/mutation_check.py (18/18). Its first run found three
vacuous proofs, now resolved:
- landed_at's per-entry skip: the symlink-loop fixture stopped raising
  once the clock moved to lstat. New fixture: a folder that lists but
  cannot be searched.
- the Desk's bench URL guard: the test covered bookmarks only. A
  hand-edited registry bench now rides with it.
- flagged_targets' `error is None`: defence in depth (hydration already
  strips a damaged mark's target), so no single-guard row; named in the
  table header instead.

The rail's flagged filter and the orphan-flag list read flagged_targets
rather than restating it; no reachable behaviour changes.

docs/contracts/r2_flow.contract.md

@@ -247,8 +247,9 @@ rule — a second renderer in JavaScript would be the same bug in a new language
 - **`flags`**: the number of CURRENT items carrying a READABLE flag mark,
   shown on every Desk row that has any — `flagged_targets(marks)` intersected
   with the booth's item rels. `flagged_targets(marks)` is the ONE flag
-  predicate. The Desk, the tray, the filmstrip, the tape and the review button
-  all read it, and an unreadable flag entry counts nowhere. A flag whose file
+  predicate. The Desk, the tray, the orphan list, the rail's `flagged` filter,
+  the tiles, the filmstrip, the tape and the review button all read it, and an
+  unreadable flag entry counts nowhere. A flag whose file
   has since been deleted is an ORPHAN: it counts on no Desk row, and the tray
   lists it (C5) so it can be cleared.
 - **`landed_at`**: the newest mtime among the booth's CONTENT — its regular