Move hostile malformed corpus out of the differential corpus dir

tests/corpus/** is owned by the differential corpus harness (which evaluates
each fixture VM-vs-compiled); the malformed inputs were being run as real
fixtures and failing. Move them to tests/hostile-malformed/ and point the
hostile suite there.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Haofei

…sts/corpus/malformed/bad-native-decl.rss …ts/hostile-malformed/bad-native-decl.rsstests/corpus/malformed/bad-native-decl.rss renamed to tests/hostile-malformed/bad-native-decl.rss tests/corpus/malformed/bad-native-decl.rss renamed to tests/hostile-malformed/bad-native-decl.rss

@@ -10,7 +10,7 @@ use proptest::prelude::*;
 /// known fail-open gaps the fuzzer surfaced (still must not panic).
 #[test]
 fn malformed_corpus_never_panics_and_fails_closed() {
-    let dir = std::path::Path::new("tests/corpus/malformed");
+    let dir = std::path::Path::new("tests/hostile-malformed");
     let mut entries: Vec<_> = std::fs::read_dir(dir)
         .expect("malformed corpus dir exists")
         .filter_map(|e| e.ok().map(|e| e.path()))