phase3: generalize trust layer for C/C++; wire cJSON target

Trust-layer generalization (zero-regression verified on tokei):
- TargetSpec [build] uses an explicit {out} isolation-dir placeholder
  instead of injected CARGO_TARGET_DIR, plus optional sanitizer/
  sanitizer_binary templates. Nothing assumes cargo anymore.
- verdict rebuild_pristine_baseline, sanitizer_check, and harnessd
  run_verdict candidate build all use {out} substitution. A target with
  no sanitizer build caps accepts at needs-human-review.
- tokei/comrak target.toml migrated to the {out} form (CARGO_TARGET_DIR=
  {out} + nightly ASan sanitizer command).

cJSON C target (v1.7.19, MIT):
- harness.c bench/golden driver (trust-layer; agent can patch workspace
  cJSON.c but not the rig), compiled with clang against the patched tree.
- 5.6 MB deterministic corpus (gen-corpus.sh) + MANIFEST/GOLDEN pins.
- gates = hermetic Unity/CTest suite (19 tests pass); sanitizer =
  ASan+UBSan; scripts/diff-fuzz-cjson.py for differential fuzzing.

coz causal profiler integration (SPEC §12):
- harness.c optional -DHOTPATH_COZ throughput progress point.
- scripts/install-coz.sh, coz-profile.sh, coz-summary.py; just coz/install-coz.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

crates/diff-test/src/target.rs

@@ -33,10 +33,31 @@ pub struct Source {
 
 #[derive(Debug, Deserialize)]
 pub struct Build {
-    /// Baseline build command, run from repo root.
+    /// Build command, run from repo root. `{out}` is substituted with an
+    /// isolation directory the harness provides (per-baseline, per-
+    /// candidate, per-sanitizer) — the command MUST place all artifacts
+    /// under it. A cargo target sets `CARGO_TARGET_DIR={out}`; a make
+    /// target builds and copies the binary to `{out}`. Language-agnostic:
+    /// nothing here assumes cargo.
     pub baseline: String,
-    /// Built binary path, relative to repo root.
+    /// Built binary path with `{out}` substituted — where `baseline`
+    /// leaves the binary given an isolation dir.
     pub binary: String,
+    /// ASan+LSan (or ASan+UBSan for C/C++) build command; `{out}`
+    /// substituted. Run on every would-be accept (SPEC §8). If absent,
+    /// an accept cannot be sanitizer-verified and is capped at
+    /// needs-human-review.
+    #[serde(default)]
+    pub sanitizer: Option<String>,
+    /// Sanitizer binary path with `{out}` substituted.
+    #[serde(default)]
+    pub sanitizer_binary: Option<String>,
+}
+
+/// Substitute the `{out}` isolation-dir placeholder in a build command or
+/// binary-path template.
+pub fn subst_out(template: &str, out_dir: &str) -> String {
+    template.replace("{out}", out_dir)
 }
 
 #[derive(Debug, Deserialize)]