phase3: cJSON cross-language win verified + audited; robustness fix; case studies

phase3-cjson-002 (class 5+3): stack-buffer number parsing + strtod
round-trip replacing sscanf. +8.85% median, 95% CI [+7.5%, +10.0%] on
the C target, banked. 100% audit: byte-identical golden replay,
independent ASan+UBSan clean, 10k-input differential fuzz 0 divergences,
patch bounds/free-gating verified by eye.

- verdict: an infrastructure sanitizer-BUILD failure (missing runtime,
  broken toolchain) now caps the accept at needs-human-review and logs
  it, instead of crashing the verdict and losing a measured bench.
- results/phase3/: four public case studies (tokei class-5 wins; build
  flags + allocators; the comrak caught false-accept; the cJSON
  cross-language proof) + README. Compound-speedup claim stated as an
  approximation, not a measured figure (CIs don't multiply).
- .gitignore: cjson build-artifact dirs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

crates/verdict/src/main.rs

@@ -136,7 +136,15 @@ fn sanitizer_check(
         .arg(diff_test::target::subst_out(build_tpl, &out_dir))
         .current_dir(root)
         .status()?;
-    anyhow::ensure!(status.success(), "sanitizer build failed");
+    if !status.success() {
+        // Infrastructure failure (missing runtime, toolchain), not a code
+        // defect: don't crash the verdict and lose a measured bench —
+        // treat "cannot build the sanitizer binary" like "no sanitizer
+        // declared" so the accept caps at needs-human-review (None), with
+        // the failure logged for the operator to fix and re-run.
+        println!("sanitizers: BUILD FAILED — cannot verify; capping accept at needs-human-review");
+        return Ok(None);
+    }
     let asan_bin = diff_test::target::subst_out(bin_tpl, &out_dir);
     let cmd = spec.bench.command.replace("{binary}", &asan_bin);
     let out = std::process::Command::new("sh")