fix(clusterfuzzlite): don't upload SARIF when a clean run produced none

#131's my-llvm .rs edit triggered the ClusterFuzzLite workflow for the first
time since the #130 build fix — validating it: fuzz_main built and ran 177M
executions in 301s with ZERO crashes. The job still failed on the final step:
`upload-sarif` runs `if: always()` but a clean run writes no
vulnerabilities.sarif, so it errored 'Path does not exist'. Guard the upload
with `hashFiles('vulnerabilities.sarif') != ''` so a no-crash run passes
cleanly. Applied to both cflite_pr.yml and cflite_batch.yml.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwV2DWsjkBiNP3oscimMLV

Author: claude

.github/workflows/cflite_batch.yml

@@ -28,6 +28,9 @@ jobs:
           mode: batch
           output-sarif: true
       - uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3
-        if: always()
+        # Only upload when a SARIF was actually produced: a CLEAN fuzz run
+        # (no crashes) writes no `vulnerabilities.sarif`, and an unconditional
+        # `always()` upload then fails with "Path does not exist".
+        if: always() && hashFiles('vulnerabilities.sarif') != ''
         with:
           sarif_file: vulnerabilities.sarif

.github/workflows/cflite_pr.yml

@@ -31,6 +31,9 @@ jobs:
           mode: code-change
           output-sarif: true
       - uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3
-        if: always()
+        # Only upload when a SARIF was actually produced: a CLEAN fuzz run
+        # (no crashes) writes no `vulnerabilities.sarif`, and an unconditional
+        # `always()` upload then fails with "Path does not exist".
+        if: always() && hashFiles('vulnerabilities.sarif') != ''
         with:
           sarif_file: vulnerabilities.sarif