docs(testing): hurl is scaffolding; target-native suites are the goal

[koolamusic]

Summary

Captures the strategic note that hurl is not a long-term
requirement for candy. Hurl was the right v0.1 conformance gate
(cross-target proof, no per-language re-authoring), but it isn't
the test surface a team adopting candy will actually run in their
day-to-day loop.

Candy should generate the test suite in the target's idiomatic
test framework alongside the feature implementation.

Two test tiers per target

Tier	Focus	Idiomatic surface (per target)
1 (focus, integration)	HTTP-level end-to-end	Go: `testing` + `httptest`. Rust: `#[tokio::test]` + axum-test. TS: vitest + `app.fetch(req)`. Python: pytest + httpx / FastAPI `TestClient`.
2 (supporting, unit)	Per-policy, per-flow, per-actor	Already proven on the Go (`policies_test.go`) and Rust (`#[cfg(test)] mod tests`) auth targets.

Each hurl scenario transliterates mechanically to one tier-1 test.
The codegen has the spec; it knows the routes, status mappings,
and expected body shapes — it can emit the target-native suite
from the same inputs.

Hurl's new role

Not deleted. Demoted to the cross-target reference contract.
A single hurl run still verifies a generated backend matches the
conformance contract. Teams running on a single target use the
language-native suite for daily work; hurl is the shared fence-line
for multi-target conformance.

Spec evolutions that would enrich tier-1 generation

Out of scope for this PR; flagged in the doc:

• `controller X { examples: ... }` — HTTP-shape examples direct
  on controllers (today examples live on `policy` blocks).
• `flow X { properties: ... }` — property-based testing surface.
• `mock external X { Op returns ... }` — declarative external
  stubbing for tier-1 tests.
• `seed:` blocks at feature level — declarative test-mode seed
  data.

Out of scope

No code changes. No commitment to specific test framework choices
beyond the conventional defaults. The doc is a strategic framing;
concrete codegen prompts for tier-1 emission land in a follow-up.

Why this matters

The diff between "candy emits hurl I have to learn" and "candy
emits `_test.go` I already read every day" is the difference
between a niche tool and a default.

Combined with brownfield mode (PR #51), this gives candy a
realistic adoption story: applies to existing code, ships in your
team's existing test idiom.

Refs

• PR docs(cli): document green and brown codegen modes #51 — green/brown CLI modes (testing strategy is what makes
  brown adoption palatable).
• `evals/README.md` — current hurl-based conformance contract.
• `.retrospective/phase-alpha-codegen.md` §8 — "no CI for codegen
  targets yet"; tier-1 native suites are the natural CI surface.