ci(fuzz): run cargo-fuzz on nightly and keep crash reproducers

rust-toolchain.toml overrides `rustup default nightly`, so the scheduled
job ran cargo-fuzz on stable and its -Z flags failed (B7). Every cargo
call now names +nightly. Also:

- upload fuzz/artifacts/node/ when the run fails;
- drop the false claim that the corpus "grows in place across
  schedules": new inputs live only in a 7-day artifact until someone
  minimises and commits them;
- pin actions by SHA as ci.yml does (checkout v4.4.0, upload-artifact
  v4.6.2), and install cargo-fuzz with --locked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/fuzz.yml

@@ -1,11 +1,12 @@
 # Fuzzing lives on `cargo fuzz`, which needs a nightly toolchain and must never
-# be part of the stable `cargo clippy --workspace` gate in ci.yml. This workflow
+# be part of the stable `cargo clippy --workspace` gate in ci.yml (ci.sh only
-# is therefore SCHEDULED (not a PR push/PR gate) and runs against the corpus
+# checks that the fuzz crate still compiles on stable). This workflow is
-# that is checked into this repo under `fuzz/corpus/node/`.
+# therefore SCHEDULED (not a PR gate) and starts from the corpus checked into
+# this repo under `fuzz/corpus/node/`.
 #
-# The 24 CPU-hour budget mentioned in Task 12 is release-time; this scheduled run
+# The 24 CPU-hour release budget (spec §7) is spent by hand before a release;
-# uses a modest per-run budget so it stays cheap while still re-executing every
+# this scheduled run uses a modest per-run budget so it stays cheap while still
-# known input and continuing to grow the corpus.
+# re-executing every known input.
 
 name: Fuzz
 
@@ -19,32 +20,48 @@ on:
 permissions:
   contents: read
 
+env:
+  CARGO_TERM_COLOR: always
+
 jobs:
   fuzz-node:
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
-        with:
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-          # The corpus is committed, so the run continues where it left off and
-          # re-runs every known crashing/non-crashing input on each schedule.
-          fetch-depth: 0
 
+      # rust-toolchain.toml pins stable, which overrides `rustup default`, so
+      # every cargo call below names `+nightly` explicitly (cargo-fuzz passes
+      # `-Z` flags that only nightly accepts).
       - name: Install nightly toolchain + cargo-fuzz
         run: |
           rustup toolchain install nightly --profile minimal --component rust-src
-          rustup default nightly
+          cargo +nightly install cargo-fuzz --locked
-          cargo install cargo-fuzz
 
-      - name: Run the Node harness against the checked-in corpus
+      - name: Run the Node harness from the checked-in corpus
-        # Re-runs every corpus entry (fast path) and then continues fuzzing for
+        # Re-runs every corpus entry first, then keeps fuzzing for the budget.
-        # the run budget. The corpus directory is part of the repo, so it grows
+        # Both input modes (basic and adversarial, chosen by the first input
-        # in place across schedules; a fresh checkout still has prior inputs.
+        # byte) run in the one `node` target.
-        run: cargo fuzz run node -- -max_total_time=1800
+        run: cargo +nightly fuzz run node -- -max_total_time=1800
 
-      - name: Upload corpus artifacts (optional retention)
+      # A crash leaves its reproducer under fuzz/artifacts/node/. Reproduce
+      # with `cargo +nightly fuzz run node <file>`.
+      - name: Upload crash reproducers
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: fuzz-artifacts-node
+          path: fuzz/artifacts/node/
+          if-no-files-found: ignore
+          retention-days: 30
+
+      # New inputs found by this run exist only on the runner and in this
+      # 7-day artifact; nothing commits them back. To keep them, download the
+      # artifact, minimise with `cargo +nightly fuzz cmin node`, and commit.
+      - name: Upload grown corpus
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: fuzz-corpus-node
           path: fuzz/corpus/node/