reg-exam-build: mutually-exclusive question groups to prevent cross-question inference leakage

[agiacalone]

Problem

On a multi-question exam, some questions leak the answer to others: a student who reads item B can back out item A's key from B's stem or options (an inference attack across items). Today reg-exam-build has no way to express "these two questions must never appear on the same variant/form together," so form assignment (§5) and any future item-pooled/individualized selection can co-locate a leaking pair.

Proposal

Add a mutually-exclusive group constraint to question metadata so the builder treats it as an assembly constraint: pick at most one item from each mutex group per form/variant.

• Question-level tag/field, e.g. mutex-group: <label> (a question may belong to 0+ groups).
• Validation (§4, fail-fast): if a single form's fixed content already contains two items sharing a mutex group, error before compile.
• Selection: when the builder chooses items for a form/variant (form assignment §5; relevant to any future item-pool mode), enforce ≤1 per mutex group.
• Applies across the form matrix (§3) — A/B/individualized should never place a mutex pair on the same paper (different forms carrying different members is fine and in fact desirable).

Design touch-points

• docs/design/exam-system.md §4 (validation), §5 (form assignment)
• manifest_schema / exam pack manifest
• Tests: add a mutex-pair fixture; assert the fail-fast on same-form collision and ≤1-per-group selection.

Origin

Surfaced administering the CECS 378 final (Su26). Vault ref: notes/cecs-378-final-exam-revisions.md#^inference-mutex.