[mdns]: Minor fixes + Mutation tests/fault injection

[david-cermak]

• Fixes some obvious OOB access in MDNS
• Adds experimental Mull engine to evaluate host/test suite

---

Note

Medium Risk
Touches network announcement/probe/bye paths in production mDNS code; changes are defensive bounds fixes with low behavioral impact if the list is stable, but errors here could affect service discovery on device.

Overview
Hardens mDNS responder/PCB paths that walk the linked service list, fill a VLA, and pass a length into probe/bye helpers. Fill loops now cap with i < srv_count (or l < srv_count) and downstream calls use the actual fill count (i / l) instead of the pre-counted srv_count, reducing risk of out-of-bounds writes if count and list diverge. restart_pcb() gets the same pattern plus a comment typo fix (probe only IP).

Host unit-test docs and tooling add test_pcb to the CMake suite list, explain ASan vs clang-tidy ArrayBound vs Mull, and wire optional Mull mutation testing via mull.yml, USING_MULL.md, and scripts/run_mull.sh (clang plugin build + SQLite reports).

^{Reviewed by Cursor Bugbot for commit 3250205. Bugbot is set up for automated code reviews on this repo. Configure here.}