feat(ci): seeded fuzz leg, and register both new legs as canonical entries

scripts/fuzz.sh drives the libFuzzer targets in two shapes from one entry:
a fixed --runs from a fixed --seed, so a CI smoke is a function of the code
and not a lottery (O9), and a time-boxed --max-total-time for exploration.
Checked-in seeds are copied into a working corpus under build/fuzz/, so a
run never rewrites the repository; a crash leaves its reproducer behind and
the script exits non-zero. Wired as a smoke into dry-run.yml and as
exploration into nightly-soak.yml.

The venue-parity contract rightly refused both workflow steps: a venue may
provision or plumb, but only a CANONICAL leg entry may exercise the
product, and neither script was registered. Registering them — rather than
working around the contract — is the fix, since both own their leg end to
end (build, corpus or binary, artifact paths, exit code) exactly as
soak-legs.sh owns the soak. _memwaste.yml joins the policed venue walk for
the same reason, and both scripts join the layer-5 interface probes.

Those probes immediately earned their keep, finding two real defects:
`fuzz.sh --help` exited 2 because the positional target consumed the flag,
and memwaste.sh read a typo'd flag as the repository path — which would
have indexed nothing and reported an empty lane as a clean one.

test_shell_line_endings.sh now degrades where the checkout has no
reachable repository metadata: the Linux container bind-mounts the working
tree, and a git worktree's .git is a pointer to the host repository, so
`git ls-files` cannot run there and the contract failed with "matched no
files — the glob set is broken", killing the leg before it compiled. It is
a repository property, so it stays gating in every venue that has the
metadata (macOS host, the Windows VM's real checkout at C:\cbm with 117
files, every hosted-CI checkout). test_version_metadata_contract.sh already
guards the same way for the same reason; the alternatives considered and
rejected are recorded at the case.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

.github/workflows/dry-run.yml

@@ -45,6 +45,10 @@ on:
         description: 'Skip candidate scan; mark unscanned and default to stripped'
         type: boolean
         default: false
+      skip_memwaste:
+        description: 'Skip the waste sanitizer (report-only) and the fuzz smoke'
+        type: boolean
+        default: false
       soak_level:
         description: 'Soak: full (quick+asan), quick (10min), none'
         type: choice
@@ -107,6 +111,38 @@ jobs:
     with:
       broad_platforms: true
 
+  # ── Waste sanitizer, REPORT-ONLY (independent island) ─────────
+  # Event lane on Linux, macOS and Windows, access lane and the per-function
+  # scaling lane on Linux. Uploads reports; fails only when the measurement is
+  # unsound (a defect of the tool itself).
+  memwaste:
+    if: ${{ inputs.skip_memwaste != true }}
+    uses: ./.github/workflows/_memwaste.yml
+    with:
+      mode: full
+
+  # ── Fuzz smoke (independent island) ───────────────────────────
+  # A fixed number of executions from a fixed seed per target, so the verdict is
+  # a function of the commit (O9). A crash here is a real defect in a parser
+  # that reads untrusted input; its reproducer is uploaded.
+  fuzz:
+    if: ${{ inputs.skip_memwaste != true }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install deps
+        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev clang llvm libclang-rt-dev
+      - name: Fuzz smoke (extract, cypher, config)
+        run: scripts/fuzz.sh all --runs 20000 --seed 1
+      - name: Upload reproducers
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: fuzz-artifacts
+          path: build/fuzz/artifacts-*/
+          if-no-files-found: ignore
+
   # ── Soak tests (optional, parallel with smoke) ────────────────
   soak:
     if: ${{ inputs.soak_level != 'none' && !cancelled() && needs.build.result != 'failure' && needs.build.result != 'skipped' }}

.github/workflows/nightly-soak.yml

@@ -35,6 +35,27 @@ permissions:
   contents: read
 
 jobs:
+  # Fuzz exploration: new inputs are the point here, so it runs for a time
+  # budget instead of a fixed count. NON-GATING like the soak; a crash uploads
+  # its reproducer, which becomes a fixed-seed regression input once fixed.
+  fuzz:
+    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install deps
+        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev clang llvm libclang-rt-dev
+      - name: Fuzz exploration (30 min per target)
+        run: scripts/fuzz.sh all --max-total-time 1800 --seed 0
+      - name: Upload reproducers
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: fuzz-artifacts-nightly
+          path: build/fuzz/artifacts-*/
+          if-no-files-found: ignore
+
   soak:
     uses: ./.github/workflows/_soak.yml
     with: