microlisp 0.1.1

First post-release iteration. Picks up the highest-ROI items from the
v0.1.0 cold review and ships a real fix that the new fuzzer found.

See the full inventory in CHANGELOG.md.

Fixed

• GC mark walker is now iterative. The v0.1.0 recursive mark_obj
  overflowed the C stack on any heap-built linked list longer than
  ~3000 cons cells (which a tail-recursive (loop n (cons n acc))
  produces almost immediately). Replaced with an explicit worklist
  held on the state; a grow-failure cleanly aborts the collection
  rather than half-marking the heap. Regression test added.

Added

• fuzz_eval runs in CI as part of the libFuzzer-smoke job. Wraps
  the invocation in a small shell guard that maps libFuzzer: out-of-memory / libFuzzer: timeout to non-failures while letting
  real ASan / UBSan / assertion findings propagate. The wrapper
  exists because the evaluator is Turing-complete -- a fuzzer-
  generated (define (loop) (loop)) (loop) legitimately exceeds any
  per-input budget.
• fuzz_read harness now drives ml_read directly instead of
  going through microlisp_eval. The reader is non-Turing-complete,
  so any timeout or OOM in fuzz_read is now a real bug worth
  investigating.
• Eight new fuzz seeds + twelve new dictionary entries so the
  mutator splices format-aware tokens into inputs more aggressively.

Source tarball

A deterministic tarball is attached: `microlisp-0.1.1.tar.gz` plus
SHA-256 checksum. Prefer the attached files for reproducible builds.

```sh
sha256sum -c microlisp-0.1.1.tar.gz.sha256
tar xzf microlisp-0.1.1.tar.gz
cd microlisp-0.1.1
cmake --preset release
cmake --build --preset release
ctest --test-dir build/release --output-on-failure
```