ci(fuzz): force RUSTFLAGS=-C target-feature=-crt-static (#168 defense)

[avrabe]

Summary

Belt-and-suspenders defense against the #168 sanitizer/crt-static failure pattern that just recurred on PR #188 (fuzz_resolver_terminates job 77662221327 and fuzz_fusion_roundtrip job 77662221339).

`fuzz.yml` already has a thoughtful "don't install musl as a target" mitigation, but that only addresses one failure mode. The underlying hazard surfaces whenever a drifted smithy runner has `target-feature=+crt-static` configured via `/etc/cargo/config.toml` or an inherited `RUSTFLAGS` env var — even on a gnu-host build, cargo-fuzz's `-Z sanitizer=address` then crashes with the canonical "sanitizer is incompatible with statically linked libc" error.

Setting `RUSTFLAGS` at the workflow env level overrides any cargo-config rustflags (cargo gives env-`RUSTFLAGS` strict precedence). On clean runners the feature was already off, so this is a harmless no-op; on drifted runners it force-disables static-crt up-front before cargo-fuzz ever calls into rustc.

What this is not

Not a replacement for the upstream smithy ask in #168 — re-imaging the rust-cpu runner pool remains the durable fix. This stops the noise on every fuzz PR landing on a drifted runner until smithy gets to it.

Test plan

• YAML parses (`check-yaml` pre-commit passed)
• Fuzz workflow runs against this PR — expect all four targets green
• Confirm no behavior change on clean runners (target feature already off, flag is a no-op)

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

✅ 33/33 approved LS entries verified

	count
Passed (≥1 test, all green)	33
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}