Should we stop fuzzing everything but `main`?

[StanFromIreland]

Originally, I think it was intended that CI Fuzz only runs on PRs targeting main:

https://github.com/python/cpython/blob/0a179e748bcf158bdcdd47f0e57a1983993f4610/Modules/_xxtestfuzz/README.rst?plain=1#L16-L18

Some time ago, however, this changed and they were backported all the way to 3.13's CI. But, this causes us many false positives, e.g., https://github.com/python/cpython/actions/runs/27207159005/job/80325961063?pr=151151, as targets are written with main in mind. Generally the issues are varying exception types, which aren't terribly difficult to add and maintain here, but other cases need not be so simple. This raises the question, should we even run CIFuzz on branches other than main?

CC @python/fuzzers

[devdanzin]

From a pure "increase chance to hit real shipped bugs" perspective, fuzzing at least the latest stable release and the alpha/beta/rc ones makes sense to me.

However, with my own fuzzers, main tends to yield the most findings and chances to discover more seem to diminish as we go back into old releases.

So, if the cost of keeping older branches fuzzable makes sense, I'd suggest keeping 3.14 and 3.15, with less resources devoted to them, the older the less.

[StanFromIreland]

with less resources devoted to them, the older the less.

Note that they aren't fuzzed by OSS Fuzz, it only does main. This is strictly limited to CI-Fuzz.