Fuzzing infrastructure for ext/async

[EdmondDantes]

Problem

Concurrency bugs in ext/async (races, deadlocks, lost wakeups, refcount
corruption) are non-deterministic and not reachable by unit tests or
byte-level fuzzing. Existing TODOs already point to such bugs:
thread_channel/019,024 race, gc_addref assert at shutdown under ASAN.

Proposed approach (incremental)

1. Property-based testing (PHP level) — random sequences of
   spawn/send/recv/cancel/close/await, check invariants (refcount==0 after
   scope, recv completes after close, etc). Cheap, CI-friendly.
2. Structure-aware libFuzzer target — sapi/fuzzer/fuzzer-async.c with
   protobuf grammar for async ops, mutated by libprotobuf-mutator, run under
   ASAN+UBSAN. Catches UAF / double-free / refcount errors in C.
3. Schedule fuzzing — scheduler decision points read "next coroutine"
   from fuzzer input → deterministic interleavings. References: Loom,
   Shuttle, CHESS, syzkaller.
4. TSAN CI build — --enable-thread-sanitizer running existing tests.

Out of scope

Byte-level fuzzing of PHP source (already covered by fuzzer-parser /
fuzzer-execute).