From what I remember when I worked as a contractor at Google, they run the mutation tests after the CI test pass, and they report the mutated code in the PR itself. I'm not sure how they implemented the false positive reporting.