phase3: generalize trust layer for C/C++; wire cJSON target

Trust-layer generalization (zero-regression verified on tokei):
- TargetSpec [build] uses an explicit {out} isolation-dir placeholder
  instead of injected CARGO_TARGET_DIR, plus optional sanitizer/
  sanitizer_binary templates. Nothing assumes cargo anymore.
- verdict rebuild_pristine_baseline, sanitizer_check, and harnessd
  run_verdict candidate build all use {out} substitution. A target with
  no sanitizer build caps accepts at needs-human-review.
- tokei/comrak target.toml migrated to the {out} form (CARGO_TARGET_DIR=
  {out} + nightly ASan sanitizer command).

cJSON C target (v1.7.19, MIT):
- harness.c bench/golden driver (trust-layer; agent can patch workspace
  cJSON.c but not the rig), compiled with clang against the patched tree.
- 5.6 MB deterministic corpus (gen-corpus.sh) + MANIFEST/GOLDEN pins.
- gates = hermetic Unity/CTest suite (19 tests pass); sanitizer =
  ASan+UBSan; scripts/diff-fuzz-cjson.py for differential fuzzing.

coz causal profiler integration (SPEC §12):
- harness.c optional -DHOTPATH_COZ throughput progress point.
- scripts/install-coz.sh, coz-profile.sh, coz-summary.py; just coz/install-coz.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

corpora/cjson/gen-corpus.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+# Deterministically generate the cjson corpus — a large synthetic JSON
+# document exercising every parse path: nested objects/arrays, strings
+# with escapes and unicode, ints, floats (the strtod/sprintf hot path),
+# booleans, nulls. No randomness — byte-identical on every machine, so
+# the MANIFEST.sha256 pin is reproducible. Run from repo root:
+#   sh corpora/cjson/gen-corpus.sh
+set -eu
+DIR="$(cd "$(dirname "$0")" && pwd)"
+OUT="$DIR/input/big.json"
+mkdir -p "$DIR/input"
+
+python3 - "$OUT" <<'PY'
+import json, sys
+
+# Deterministic: a fixed linear-congruential stream, no `random` module,
+# so output is identical everywhere.
+class Det:
+    def __init__(self, seed=2463534242):
+        self.s = seed
+    def next(self):
+        self.s ^= (self.s << 13) & 0xFFFFFFFF
+        self.s ^= (self.s >> 17)
+        self.s ^= (self.s << 5) & 0xFFFFFFFF
+        return self.s & 0xFFFFFFFF
+    def rng(self, n):
+        return self.next() % n
+
+d = Det()
+WORDS = ["alpha","bravo","charlie","delta","echo","foxtrot","golf","hotel",
+         "quote\"inside","tab\tchar","new\nline","back\\slash","unécode","☃snow"]
+
+def record(i):
+    return {
+        "id": i,
+        "guid": f"{d.next():08x}-{d.next():04x}",
+        "active": bool(d.rng(2)),
+        "score": d.rng(1000000) / 1000.0,     # float -> strtod/sprintf path
+        "ratio": d.rng(1 << 30) / (1 << 30),  # dense fractional float
+        "count": d.rng(1 << 31) - (1 << 30),  # signed int
+        "name": WORDS[d.rng(len(WORDS))] + str(d.rng(9999)),
+        "tags": [WORDS[d.rng(len(WORDS))] for _ in range(d.rng(6))],
+        "coords": [d.rng(1 << 20) / 997.0 for _ in range(3)],
+        "meta": None if d.rng(4) == 0 else {
+            "created": d.next(),
+            "nested": {"a": d.rng(100), "b": [d.rng(50) for _ in range(d.rng(4))]},
+        },
+    }
+
+doc = {
+    "schema": "hotpath.cjson.corpus/v1",
+    "generated_by": "gen-corpus.sh (deterministic)",
+    "records": [record(i) for i in range(20000)],
+}
+with open(sys.argv[1], "w") as f:
+    json.dump(doc, f, ensure_ascii=False, separators=(",", ":"))
+PY
+
+echo "wrote $OUT ($(wc -c < "$OUT") bytes)"
+# Pin the corpus and regenerate the manifest.
+( cd "$DIR/input" && find . -type f -print0 | sort -z | xargs -0 sha256sum ) > "$DIR/MANIFEST.sha256"
+echo "manifest: $DIR/MANIFEST.sha256"