Fuzz harness: wire PR-gating and nightly arms into CI #31

Part of #22. Depends on the harness skeleton; best done once at least one generator dimension has landed.

The harness is only worth building if it gates merges. Wire two arms.

PR arm

Runs in the existing unit_test job as an ordinary cargo test. Small default iteration count (~100), single partition for reproducibility, fixed default seed. Target: well under a minute, so it is never the reason someone skips CI.

Also runs in the macos job by construction, since that job runs cargo test --workspace. That matters — #19 was observed only on macOS/aarch64, where the store mounts buffered rather than through io-uring, and the macOS job is currently the only coverage of that path.

Nightly arm

High iteration count, rotating seed (derive from the date so a failure is reproducible from the run log), longer per-query deadline. Add it to the existing nightly-fuzz workflow rather than creating a third one.

On failure the job output must contain the exact reproduce line, including seed, iteration count, and the generated configuration — a nightly failure nobody can reproduce locally is noise.

Acceptance

• A PR that reverts any of the fix(reader): don't apply limit before the row filter #11, fix(reader): read the cache in cache-sized batches #15, or fix(reader): keep column-free conjuncts in the row filter #20 fixes goes red on the PR arm.
• The nightly arm's failure output can be pasted into a local shell and reproduces.
• The PR arm's wall-clock cost is measured and recorded in the issue, so the budget is explicit rather than assumed.