phase3: generalize trust layer for C/C++; wire cJSON target

Trust-layer generalization (zero-regression verified on tokei):
- TargetSpec [build] uses an explicit {out} isolation-dir placeholder
  instead of injected CARGO_TARGET_DIR, plus optional sanitizer/
  sanitizer_binary templates. Nothing assumes cargo anymore.
- verdict rebuild_pristine_baseline, sanitizer_check, and harnessd
  run_verdict candidate build all use {out} substitution. A target with
  no sanitizer build caps accepts at needs-human-review.
- tokei/comrak target.toml migrated to the {out} form (CARGO_TARGET_DIR=
  {out} + nightly ASan sanitizer command).

cJSON C target (v1.7.19, MIT):
- harness.c bench/golden driver (trust-layer; agent can patch workspace
  cJSON.c but not the rig), compiled with clang against the patched tree.
- 5.6 MB deterministic corpus (gen-corpus.sh) + MANIFEST/GOLDEN pins.
- gates = hermetic Unity/CTest suite (19 tests pass); sanitizer =
  ASan+UBSan; scripts/diff-fuzz-cjson.py for differential fuzzing.

coz causal profiler integration (SPEC §12):
- harness.c optional -DHOTPATH_COZ throughput progress point.
- scripts/install-coz.sh, coz-profile.sh, coz-summary.py; just coz/install-coz.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

scripts/coz-profile.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+# coz causal profiling for a C/C++ target (SPEC §12). Unlike a flat
+# profiler (callgrind ranks where time is SPENT), coz measures where a
+# speedup would actually RAISE throughput — it virtually speeds up each
+# line and reports the causal effect on the harness's progress points.
+# Use it to rank playbook targets when the flat profile is ambiguous.
+#
+#   scripts/coz-profile.sh cjson [iters]
+#
+# Requires: coz on PATH (build: git clone github.com/plasma-umass/coz &&
+# see scripts/install-coz.sh) and the target's harness built with
+# -DHOTPATH_COZ (this script does that). Output: results/<target>/coz/
+set -eu
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+TARGET=${1:?usage: coz-profile.sh <target> [iters]}
+ITERS=${2:-200}
+OUT="$ROOT/results/$TARGET/coz"
+mkdir -p "$OUT"
+
+command -v coz >/dev/null 2>&1 || {
+    echo "coz not on PATH — run scripts/install-coz.sh first" >&2
+    exit 1
+}
+
+# coz needs debug line info and the progress point compiled in.
+BIN="$OUT/cjson-bench-coz"
+clang -O2 -g -gdwarf-4 -DHOTPATH_COZ \
+    -I "$ROOT/targets/$TARGET/workspace" \
+    -I "$(dirname "$(command -v coz)")/../include" \
+    -o "$BIN" \
+    "$ROOT/targets/$TARGET/harness.c" \
+    "$ROOT/targets/$TARGET/workspace/cJSON.c" \
+    -ldl
+
+cd "$ROOT"
+coz run --output "$OUT/profile.coz" --- \
+    "$BIN" corpora/$TARGET/input/big.json "$ITERS" >/dev/null
+
+echo "coz profile written: $OUT/profile.coz"
+echo "view at https://plasma-umass.org/coz/ (load the .coz file) or:"
+echo "  python3 scripts/coz-summary.py $OUT/profile.coz"