fix(ci): exclude _attic/ from deno test; guard CFL upload-sarif on file existence

deno test -A was picking up legacy Node.js files in _attic/ that use
require() (not valid in Deno), causing test failures.  Add test.exclude
to deno.json to match the existing lint/fmt exclusions.

ClusterFuzzLite upload-sarif step was failing with "path does not
exist" when the fuzzer found no bugs (no vulnerabilities.sarif
produced).  Guard the step with hashFiles() so it only runs when
the SARIF report actually exists.

https://claude.ai/code/session_01EJLZKDtcF1RGdKx6TcUTQG

Author: claude

.github/workflows/cflite_pr.yml

@@ -26,6 +26,6 @@ jobs:
           mode: code-change
           output-sarif: true
       - uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3
-        if: always()
+        if: always() && hashFiles('vulnerabilities.sarif') != ''
         with:
           sarif_file: vulnerabilities.sarif

deno.json

@@ -8,5 +8,10 @@
     "exclude": [
       "playground/experiments/_attic/"
     ]
+  },
+  "test": {
+    "exclude": [
+      "playground/experiments/_attic/"
+    ]
   }
 }