refactor: rename Flux to Mux and centralize project version

[Patel230]

Summary

Rename the provider runtime from Flux to Mux throughout the module, public Go identifiers, SDKs, configuration, state paths, CI, and documentation. Keep the project version at the root VERSION value and generate distribution metadata from that single source. Companion PR GrayCodeAI/decoder#346 consumes the signed Mux commit in this PR; merge Mux before Decoder.

Changes

• Rename the module/import path to github.com/GrayCodeAI/mux, public branded types to Mux*, and configuration/state prefixes to Mux.
• Require Go 1.27.2 across modules, CI and development documentation. Update analysis tools and build gosec in an isolated module with a compatible Go export-data reader.
• Embed VERSION for the root library and generate lower-provider version defaults, SDK manifests and OpenAPI metadata with make version-sync; CI/release checks reject drift.
• Preserve the existing incompatible v0.0.1 tag and retract it rather than rewriting history. Use a commit pin or @main until a compatible post-rename release is published.

Provider / API impact

The Go module path, branded exported identifiers, environment variables, state paths and User-Agent prefix change. Consumers must migrate imports and configuration. The host-facing engine contract is otherwise unchanged; its frozen-surface tests and boundary guards pass. Provider protocols and third-party API version fields retain their existing values.

Testing

Three local verification rounds passed across both repositories: full builds and test compilation, targeted runtime tests, rename audits, version metadata checks, standalone CLI/version checks, SDK syntax/compilation, YAML/JSON parsing and boundary guards. Both the pinned CI formatter and the current local formatter pass. make lint, go vet and module checksum verification pass.

Mux passes the native gosec and vulnerability scans locally. Final GitHub CI passed all 17 jobs on signed commit 872aad18ec16dd0ccf330b2eda739da197b75de7, including full race/coverage tests, all four fuzz targets, security scans and five platform builds. Clean committed-tree verification also passed all 72 cross-repository checks. All commits have verified SSH signatures.

Checklist

• Commits follow Conventional Commits
• make build passes
• make lint passes
• Full race test suite passes in GitHub CI (local full runtime tests require listener sockets denied by the sandbox)
• New or changed code has relevant validation
• Public APIs have godoc comments
• CHANGELOG updated under Unreleased
• Provider regression suite passes in GitHub CI
• No secrets, tokens, or PII added
• No Co-authored-by trailers