ci: green the two red checks (CodeQL→Rust, PR fuzzing→cargo-fuzz) + pin lint toolchain (#89)

Fixes the two long-standing red CI checks on `main` and locks the lint
toolchain. **No application code changes** — all three are
`.github/workflows` fixes.

## 1. CodeQL → analyze Rust
The matrix only scanned `javascript-typescript`, but the repo has **zero
JS/TS files**, so CodeQL returned a `configuration error` on every run.
Switched to `language: rust` (build-mode `none`) — actual security
coverage instead of a guaranteed failure.

## 2. PR fuzzing → native cargo-fuzz
The `PR (address)` check was ClusterFuzzLite, whose `build_fuzzers`
action **hardcodes `.clusterfuzzlite/Dockerfile`**. This repo is
**Containerfile-only** (enforced by `contractile.just` /
`Trustfile.a2ml`), so it failed with `open Dockerfile: no such file or
directory`. Replaced with a native `cargo-fuzz` job that runs the
existing `fuzz/fuzz_targets/fuzz_input.rs` target directly on the runner
— **no container, no Dockerfile, no podman**. (`cflite_pr.yml` removed,
`fuzz-pr.yml` added; the `PR` job + `address` matrix names are preserved
so the check name is unchanged. The `.clusterfuzzlite/` harness is left
in place for the scheduled batch workflow.)

## 3. Pin the Build Check toolchain
`dtolnay/rust-toolchain` pinned to `1.96.0` (kept in sync with
`rust-toolchain.toml`) so a floating `stable` can't reintroduce the
fmt/clippy skew that previously reddened `main`.

## Verification note
CodeQL-Rust and cargo-fuzz can only be exercised in CI, not locally — so
this PR's own checks are the validation. Will iterate if either needs
adjustment.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_013wg3Mtq2QFhYi4XVw1Z6z7

---
_Generated by [Claude
Code](https://claude.ai/code/session_013wg3Mtq2QFhYi4XVw1Z6z7)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/cflite_pr.yml

@@ -27,7 +27,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          - language: rust
             build-mode: none
     steps:
       - name: Checkout

.github/workflows/codeql.yml

@@ -0,0 +1,43 @@
+# SPDX-License-Identifier: MPL-2.0
+# Native cargo-fuzz PR smoke. Replaces ClusterFuzzLite, whose build_fuzzers
+# action hardcodes `.clusterfuzzlite/Dockerfile` with no override -- this repo's
+# convention is Containerfile-only (enforced by contractile.just / Trustfile.a2ml),
+# so we run the existing fuzz/ targets directly on the runner: no container,
+# no Dockerfile, no podman required.
+name: PR fuzzing (cargo-fuzz)
+on:
+  pull_request:
+    branches: [main]
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  PR:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Install Rust nightly + rust-src
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # nightly (via toolchain input)
+        with:
+          toolchain: nightly
+          components: rust-src
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+      - name: Build fuzz targets (${{ matrix.sanitizer }})
+        run: cargo +nightly fuzz build --sanitizer ${{ matrix.sanitizer }}
+      - name: Run fuzz targets (${{ matrix.sanitizer }}, code-change smoke)
+        run: |
+          for target in $(cargo +nightly fuzz list); do
+            echo "::group::fuzz ${target}"
+            cargo +nightly fuzz run --sanitizer ${{ matrix.sanitizer }} "${target}" -- \
+              -max_total_time=60 -rss_limit_mb=4096
+            echo "::endgroup::"
+          done

.github/workflows/fuzz-pr.yml

@@ -55,6 +55,11 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        with:
+          # Keep in sync with rust-toolchain.toml. Pins the lint gate so a
+          # floating `stable` cannot reintroduce a fmt/clippy skew on main.
+          toolchain: "1.96.0"
+          components: clippy, rustfmt
 
       - name: Cache cargo registry
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4