phase3: generalize trust layer for C/C++; wire cJSON target

Trust-layer generalization (zero-regression verified on tokei):
- TargetSpec [build] uses an explicit {out} isolation-dir placeholder
  instead of injected CARGO_TARGET_DIR, plus optional sanitizer/
  sanitizer_binary templates. Nothing assumes cargo anymore.
- verdict rebuild_pristine_baseline, sanitizer_check, and harnessd
  run_verdict candidate build all use {out} substitution. A target with
  no sanitizer build caps accepts at needs-human-review.
- tokei/comrak target.toml migrated to the {out} form (CARGO_TARGET_DIR=
  {out} + nightly ASan sanitizer command).

cJSON C target (v1.7.19, MIT):
- harness.c bench/golden driver (trust-layer; agent can patch workspace
  cJSON.c but not the rig), compiled with clang against the patched tree.
- 5.6 MB deterministic corpus (gen-corpus.sh) + MANIFEST/GOLDEN pins.
- gates = hermetic Unity/CTest suite (19 tests pass); sanitizer =
  ASan+UBSan; scripts/diff-fuzz-cjson.py for differential fuzzing.

coz causal profiler integration (SPEC §12):
- harness.c optional -DHOTPATH_COZ throughput progress point.
- scripts/install-coz.sh, coz-profile.sh, coz-summary.py; just coz/install-coz.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

scripts/install-coz.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# Install the coz causal profiler (SPEC §12). Tries the distro package
+# first, then a source build. Idempotent — skips if `coz` is already on
+# PATH. Run as a user that can apt-install (root in the dev container).
+set -eu
+
+if command -v coz >/dev/null 2>&1; then
+    echo "coz already installed: $(command -v coz)"
+    exit 0
+fi
+
+echo "installing coz…"
+if apt-get install -y coz-profiler >/dev/null 2>&1; then
+    echo "installed via apt: $(command -v coz)"
+    exit 0
+fi
+
+# Source build fallback.
+apt-get install -y python3 libelf-dev libdwarf-dev build-essential git >/dev/null 2>&1 || true
+SRC=/opt/coz-src
+rm -rf "$SRC"
+git clone --depth 1 https://github.com/plasma-umass/coz.git "$SRC"
+make -C "$SRC" >/dev/null
+make -C "$SRC" install >/dev/null
+command -v coz >/dev/null 2>&1 && echo "installed from source: $(command -v coz)" || {
+    echo "coz install failed" >&2
+    exit 1
+}