fix(rust): seed libFuzzer fuzz_target! harnesses as reachability entry points

[gadievron]

What

Treat libFuzzer fuzz_target! harnesses as reachability entry points in the Rust parser, so a library's fuzzed untrusted-decode surface is analyzed instead of pruned as dead code.

Why

OpenAnt's reachability filter seeds a forward BFS from entry points (main / route / CLI handler). A pure library ships none of those, so its public decode API — the exact surface a fuzz harness drives — was pruned before analysis. A crate's fuzz_target! harnesses are the authors' in-code declaration of that untrusted-input surface, but the Rust parser saw them as empty macro bodies: tree-sitter leaves a macro's token-tree opaque, so the closure body emitted no function_item and its decode calls never entered the call graph (libs/openant-core/parsers/rust/function_extractor.py).

How

• Synthesize an entry-point unit from each fuzz_target! closure body, lifted as ordinary Rust and walked so nested fn/impl/struct become their own same-file units (function_extractor.py _handle_fuzz_target). Seed-only: the harness is kept in analyzer_output for call-graph symmetry but excluded from Stage-1 analysis units (unit_generator.py:51).
• Keep-all safety net when the only entry points are synthetic harnesses (pure-library-plus-fuzz), so a crate whose real API is macro-hidden is not silently blacked out (parsers/rust/test_pipeline.py).
• Recover scoped Type::method( calls inside scannable macros (assert! / assert_eq! / …), so the most common harness idiom assert!(Type::roundtrip(d)) seeds its target rather than zero edges (call_graph_builder.py _MACRO_CALL_RE + _scan_macro_body, routed through the existing _resolve_scoped).
• Harden the expr-form lift: a trailing // comment no longer swallows the body terminator and drops the harness, and a struct-destructure closure param (|Wrap { inner }: Wrap| …) is no longer mis-lifted as the body (function_extractor.py).
• Keep scoped recovery add-only on a leaf-name collision: when a scoped qualifier binds nothing and the leaf is shared by a free fn and a method, delegate the fallback to the bare resolver so no edge master produced is dropped (call_graph_builder.py _resolve_scoped Step 4).
• Forward --library-mode through the Go CLI on both the parse and scan paths (apps/openant-cli/cmd/parse.go, scan.go).

Reachability impact

Measured whole-branch vs master, production config (--skip-tests), via the real pipeline:

• neqo: reachable 854 → 967 (+113, −0 removed); edges +305, the 5 removed edges all bare→scoped retargets to the correct method (e.g. tests::is_known_type → WebTransportFrame.is_known_type), 0 pure loss.

The change adds real reachability (recovers the fuzz/decode/scoped surface) and removes phantom production→test reachability. On hyper the branch is reachable −2 (tests::length, Encoder.is_eof) — a correct de-phantoming, not a regression: master mis-resolved a production Encoder::length(...) call to a same-named #[cfg(test)] helper length, and scoped recovery now binds it to the real method. Both de-reached nodes were reachable only through that production→test phantom (verified: tests::length's sole master inbound was the production Server.encode_headers). No genuinely-reachable production code is de-reached.

Tests

$ /Users/gadievron/.openant/venv/bin/python -m pytest tests/ -q   # from libs/openant-core
2688 passed, 30 skipped, 1 warning in 34.26s

$ git diff master..HEAD -- 'libs/openant-core/tests/**' | grep -cE '^\+\s*def test_'
19

19 new test functions (16 in test_rust_fuzz_target.py, 3 in test_rust_macro_string_literal.py), each a RED→GREEN regression for one behavior above. Static analysis on the changed files: ruff 0, go vet 0, semgrep 9 files / 373 rules / 0 findings, codeql python-security-and-quality 174 queries / 0 findings.

Compatibility

No breaking change. fuzz_target! seeding is default-on and structural (no LLM call). --library-mode is opt-in. The keep-all net only widens output (never prunes more) for pure-library-plus-fuzz repos.

Notes

• Scope: 2 concern areas (Rust parser + Go CLI wiring for --library-mode); 607 LOC. Cohesive around one feature (library-reachability via fuzz harnesses).
• Pre-existing gap, not introduced here: the repo has no tests/parsers/rust/test_callgraph_symmetry.py (only Python ships that canonical file today). Suggest a follow-up infra PR rather than bundling it.

Author notes

• Which lines implement the fix: function_extractor.py _handle_fuzz_target (harness synthesis + expr-form lift); call_graph_builder.py _MACRO_CALL_RE/_scan_macro_body (scoped-call recovery) and _resolve_scoped Step 4 (add-only fallback); unit_generator.py:51 (seed-only skip); test_pipeline.py (keep-all net).
• One input the old code handled wrong: a hybrid crate (real bin + fuzz harness) with fuzz_target!(|d| { assert!(Codec::roundtrip(d)); }) — old code seeded zero edges and silently pruned Codec::roundtrip and its transitive decode sink; new code seeds them.
• Likely reviewer pushback + answer: "Does this reduce reachability precision / lose edges?" — No: measured add-only on neqo (reachable −0); the only reachability removed anywhere is a production→test phantom (hyper −2), which is a precision gain. Verified first-hand against a genuine master worktree across 8 repos.