test: add reliability oracles and bounded fuzzing

[jleni]

Summary

• add a generated differential oracle that compares Kache cold/hit/change/hit behavior with bare rustc across six semantic input changes
• prove bounded file and pack-frame ranges with Kani, and fix the discovered Some(0) versus unknown compile-cost ordering bug
• add bounded properties for argument transport, remote packs, and remote layout round-trips
• add a native-archive libFuzzer target, structural seed corpus, stable regression replay, and a daily bounded fuzz workflow

Reliability and CI design

• repository Kani covers 8 harnesses across kache-core and the unpublished proof crate; packaged kache-core remains independently verifiable with its 6 self-contained harnesses
• pull requests only compile fuzz targets when fuzz/parser paths change; scheduled/manual runs fuzz for 600 seconds and persist the evolving corpus
• all actions remain SHA-pinned, fuzz inputs are capped at 1 MiB, and runtime/RSS/per-input limits are explicit
• delivered as one PR with three signed commits to avoid multiplying CI runs

Validation

• full workspace tests: green (2,197 main unit tests plus integrations at the initial full gate; proof crate baseline included in final mutation runs)
• Clippy with -D warnings: green
• Kani 0.67.0: 8/8 harnesses verified, 8/8 covers satisfied; packaged kache-core: 6/6
• cargo-mutants 27.1.0:
  • core: 53 caught, 46 unviable, 0 missed/timeouts
  • changed lines: 27 caught, 8 unviable, 0 missed/timeouts
• libFuzzer seed 843: 704,572 post-fix executions, no crash/timeout; compile and regression replay green
• cargo package for kache-core and kache: green
• cargo-deny audit, action pin verification, formatting, and test-resource guard: green