phase3: diff-test resolves {out}-templated binary; CI gates cjson

diff-test standalone (just gates / CI target-gates) passed the now-
templated build.binary into golden replay verbatim — literal {out}.
It now builds the current tree to targets/<t>/gates-build and tests
that, with a --binary override. CI's target-gates-no-net job gains
clang/cmake, fetches+gates the cjson C target (clang build -> Unity/
CTest -> golden replay) alongside tokei.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

.github/workflows/ci.yml

@@ -25,18 +25,24 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
+      - name: Toolchains for C/C++ targets
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq clang cmake
       - name: Fetch pinned targets
         run: |
           sh targets/fetch.sh comrak
           sh targets/fetch.sh tokei
+          sh targets/fetch.sh cjson
       - name: Generate + verify pinned corpora
         run: |
           sh corpora/comrak/gen-corpus.sh
           sh corpora/tokei/gen-corpus.sh
+          sh corpora/cjson/gen-corpus.sh
       - name: Build tokei baseline
         run: cargo build --release --manifest-path targets/tokei/workspace/Cargo.toml
-      - name: Gates (corpus pin -> upstream tests -> golden replay)
+      - name: Gates — tokei (Rust; corpus pin -> upstream tests -> golden replay)
         run: cargo run -p diff-test -- tokei
+      - name: Gates — cjson (C; clang build -> Unity/CTest -> golden replay)
+        run: cargo run -p diff-test -- cjson
       - name: Bench workload inside no-network container
         run: |
           docker run --rm --network=none \