Phase 3a adds a cargo-fuzz harness over three targets (codec, container,
chain), an honesty oracle that lives in the library so its own invariants
are unit-testable, a generated seed corpus, a blocking CI smoke job and a
scheduled deep run.

The harness found six pre-existing bugs before it ever reached CI. Five
change a user-visible exit code, every one of them away from exit 1 --
which means 'stuffr failed' -- toward a code that describes the input:

  * NotSeekable on a piped archive: 1 -> 3. It is the mandated reply to
    by_index on a forward-only source, so every valid archive read from a
    pipe was reporting an internal failure for a by-design refusal.
  * A malformed stream with no container above it: 1 -> 5. 'stuffr list'
    said 'i/o error' where 'stuffr cat' on the same bytes said 'corrupt'.
  * A zip entry lying about its declared size: 0 -> 5. A stored entry
    declaring 42 bytes, 0 compressed, crc 0 satisfies its own crc32, so
    'test --strict-fidelity' announced exact fidelity over an empty read.
  * A zip index reaching no entries at all: 0 -> 5. Zero entries and a
    clean fidelity verdict for a file whose four entries the same binary
    recovers in full when the bytes arrive on a pipe.
  * A 68-byte .a file: panic at 101 -> 5.
  * cpio and ar header lengths reaching an allocator before validation:
    multi-gigabyte allocations from a few bytes of header, now exit 6.

A script branching on exit 1 for any of these was branching on a bug.

Also: ar is pinned =0.9.0, since ar.rs mirrors eight private facts about
its header state machine and a desync would surface as a false refusal on
a valid archive.