fix(fuse): add --reproducible for byte-stable output (#325)

[avrabe]

What

Adds a --reproducible flag so meld fuse produces a byte-identical artifact for identical input, fixing the sha256-nondeterminism reported in #325.

Root cause (measured, not guessed)

A structural diff of two nondeterministic outputs showed the only differing bytes are in the wsc.transformation.attestation custom section: a random attestation_id UUID + a wall-clock timestamp. Everything else is already deterministic — --no-attestation is byte-identical across runs, and the section's embedded output.hash is stable. (The issue guessed HashMap iteration order; the diff ruled that out.)

Fix

--reproducible (→ FuserConfig.reproducible). When set:

• attestation_id ← derived from the output content (entropy_from_hex(output_hash) → generate_uuid_from), so it's a stable content fingerprint instead of a random UUID.
• timestamp ← from the ecosystem-standard SOURCE_DATE_EPOCH (default epoch 0 → 1970-01-01T00:00:00Z) via chrono_timestamp_from, instead of the system clock.

Both attestation builders are covered: the default FusionAttestationBuilder::build() path and the feature = "attestation" build_wsc_attestation path (they share the section name wsc.transformation.attestation; the default build uses the former).

Verification (end-to-end)

• --reproducible → identical sha256 across 3 runs ✓
• SOURCE_DATE_EPOCH=0 --reproducible → timestamp 1970-01-01T00:00:00Z ✓
• control (no flag) → still varies (2 distinct) ✓
• Regression test test_reproducible_attestation_is_byte_stable asserts reproducible runs are byte-equal and that the control differs (so the flag can't silently become a no-op).
• Pre-commit gate green: fmt, clippy, full test suite.

Non-Tier-5 (attestation/config/CLI only). The new FuserConfig field is threaded through the existing explicit test literals.

Refs #325.

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

✅ 58/58 approved LS entries verified

	count
Passed (≥1 test, all green)	58
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}