fix(clusterfuzzlite): ASan-only fuzzing — drop unsupported undefined sanitizer (#130)

## What

Follow-up to #129. #129 fixed the ClusterFuzzLite **build** (clean
`Dockerfile` + `build.sh`), and CI confirmed it works — the image builds
and `fuzz_main` compiles + stages. The only remaining red was the
**`undefined` sanitizer** matrix variant:

```
BAD BUILD: UBSan build of fuzz_main seems to be compiled with ASan.
ERROR: 100.0% of fuzz targets seem to be broken.
```

This is fundamental, not a config typo: **Rust/cargo-fuzz cannot emit a
valid UndefinedBehaviorSanitizer binary** — it links ASan regardless —
so OSS-Fuzz's `bad_build_check` rejects it. The `undefined` job could
never produce real UBSan coverage. Standard Rust OSS-Fuzz practice is
ASan-only.

## Changes
- `cflite_pr.yml` / `cflite_batch.yml`: matrix `sanitizer: [address]` —
removes the broken `PR (undefined)` job.
- `.clusterfuzzlite/project.yaml`: `sanitizers: [address]`.
- `.clusterfuzzlite/build.sh`: pass `--sanitizer
"${SANITIZER:-address}"` explicitly.

Each change carries an inline comment explaining the Rust/UBSan
limitation. The `address` variant (whose build already works per #129)
is retained, so ASan fuzzing continues.

## Verification
`bash -n .clusterfuzzlite/build.sh` OK; config greps confirm `[address]`
everywhere. The full OSS-Fuzz image build isn't runnable in this
environment, so this is correct-by-spec — the `address` job exercises it
in CI.

## Out of scope (separate, tracked)
The `Validate Hypatia Baseline` red is the pre-existing Hypatia backlog
(issue #34): the now-working analyzer reports 25 findings ≥ medium
against an empty `.hypatia-baseline.json`. Resolving it needs the actual
findings (artifact `hypatia-scan-findings`/the Security tab), which
aren't reachable from the CI sandbox — to be fixed at source once the
list is in hand, per the repo's fix-don't-suppress discipline.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01BwV2DWsjkBiNP3oscimMLV

---
_Generated by [Claude
Code](https://claude.ai/code/session_01BwV2DWsjkBiNP3oscimMLV)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.clusterfuzzlite/build.sh

@@ -6,7 +6,10 @@
 # `fuzz/` and stage each binary into $OUT. Run by `compile` inside the
 # base-builder-rust image (see .clusterfuzzlite/Dockerfile).
 cd "$SRC/my-lang"
-cargo +nightly fuzz build -O
+# Build for the sanitizer OSS-Fuzz requests (defaults to address). NOTE: only
+# `address` is configured — Rust/cargo-fuzz cannot emit a valid UBSan binary
+# (it links ASan regardless), which `bad_build_check` rejects; see project.yaml.
+cargo +nightly fuzz build -O --sanitizer "${SANITIZER:-address}"
 
 release="$SRC/my-lang/fuzz/target/x86_64-unknown-linux-gnu/release"
 for target in fuzz/fuzz_targets/*.rs; do

.clusterfuzzlite/project.yaml

@@ -1,6 +1,9 @@
 homepage: "https://github.com/hyperpolymath/my-lang"
 language: rust
 main_repo: "https://github.com/hyperpolymath/my-lang"
+# Only ASan: Rust/cargo-fuzz does not produce a valid UndefinedBehaviorSanitizer
+# build (it links ASan regardless), which OSS-Fuzz's `bad_build_check` rejects
+# ("UBSan build ... seems to be compiled with ASan"). ASan is the supported,
+# meaningful sanitizer for Rust fuzzing here.
 sanitizers:
   - address
-  - undefined

.github/workflows/cflite_batch.yml

@@ -11,7 +11,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        sanitizer: [address, undefined]
+        # ASan only: Rust/cargo-fuzz can't emit a valid UBSan binary (links ASan
+        # regardless), so `undefined` failed bad_build_check. See project.yaml.
+        sanitizer: [address]
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1

.github/workflows/cflite_pr.yml

@@ -14,7 +14,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        sanitizer: [address, undefined]
+        # ASan only: Rust/cargo-fuzz can't emit a valid UBSan binary (links ASan
+        # regardless), so `undefined` failed bad_build_check. See project.yaml.
+        sanitizer: [address]
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1