refactor(core): compile the mock provider only with a testing feature

Phase 3a of docs/DESIGN.md. MockProvider moves to api/mock.rs, and it,
the embedded MSN fixture bodies, and the IDX_MOCK_* hooks compile only
with idx-core's new `testing` feature. idx-cli enables it as a
dev-dependency, so `cargo test` keeps the fixture-backed provider while
release binaries no longer embed fixture data or honor
IDX_USE_MOCK_PROVIDER. Parser helpers used only by the mock are gated
the same way.

The packaged-cli flake check no longer relies on the mock; it checks
an offline cache miss (JSON CACHEMISS, exit 3) instead.

Goldens unchanged; clippy is clean with and without `testing`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/CONVENTIONS.md

@@ -121,7 +121,7 @@ let conn = Connection::open(path)
 - **Output contracts:** parse JSON from stdout on success and stderr on failure; errors must leave stdout empty. Assert meaningful values, types, and stable error codes rather than substrings or diagnostic wording.
 - **Stateful workflows:** compare cached data across offline/failure transitions, and verify failed snapshot updates preserve both database bytes and query results. Put behavioral coverage in `tests/cli.rs`, not shell smoke.
 - **Fixtures:** `tests/fixtures/*.json` — real API responses, sanitized
-- **No live API calls in CI** — `IDX_USE_MOCK_PROVIDER=1`
+- **No live API calls in CI** — `IDX_USE_MOCK_PROVIDER=1` selects the fixture-backed mock provider, which exists only when idx-core's `testing` feature is on (idx-cli enables it as a dev-dependency, so `cargo test` has it and release builds do not)
 - **Test naming:** `test_<function>_<scenario>` (e.g., `test_parse_id_number_with_dots`)
 - **Coverage over counts:** replacing redundant unit assertions with stronger integration scenarios must retain meaningful error, boundary, and data-integrity coverage.