v0.9.5

Added

• ripfuzz test <harness> finds broken invariants. It compiles a harness
  through solc, deploys it on a sandbox chain, fuzzes handler sequences, checks
  invariant_* functions after every call on a throwaway clone, shrinks each
  reproduction, and writes traces and an lcov.info coverage report under
  .ripfuzz/. Broken invariants are rvm.bail(Invariant) reports,
  deduplicated by id, and argument generation is seeded from harness literals.

• ripfuzz max <harness> maximizes harness value(). Coverage-guided search
  uses per-call value deltas, shrinks the best sequence, persists a JSON
  corpus, and writes the same traces and coverage report as ripfuzz test.
  Optional setup and summary functions run around the campaign.

• ripfuzz exec <script> compiles a Solidity script, deploys it, runs exec()
  once, prints logs, and saves the execution trace.

• ripfuzz init writes a starter ripfuzz.toml and refuses to overwrite an
  existing file.

Changed

• Harnesses compile through solc from ripfuzz.toml, not Foundry
  forge build. Solc settings live under [solc], with version required.
  The legacy flat solc = "0.8.36" form is rejected. Compilation resolves
  remappings from the config and {root}/remappings.txt.

• Replaced rvm.finding and the assert(false) panic workflow with
  rvm.bail(Invariant).

Removed

• ripfuzz run and the Foundry-based campaign stack. Use ripfuzz test to
  find broken invariants and ripfuzz max to maximize value().

• The rvm.getCode cheatcode.

Fixed

• Tester campaigns keep the shortest reproducing sequence for each broken
  invariant id, so a later one-call hit replaces a longer first hit.

• Signed-integer argument generation now uses extracted negative literals, so
  gates below 256 bits are reachable.

• ripfuzz max generates arguments for handlers that take struct parameters,
  including arrays and nested structs.

• ripfuzz loads {cwd}/.env at startup for every command, so vm.getEnv
  works in test, max, and exec.