fix: harden fuzz workflow inputs

[berisher]

Description

Harden the fuzz workflow dispatch inputs and crash-check behavior.

This change removes direct workflow_dispatch input interpolation from the
custom and thorough fuzzing jobs, constrains the workflow token to read-only
contents access, and makes crash-check steps fail when fuzzing never reached the
artifact-writing phase.

Related Issue

Batch remediation from Hunter campaign pickle-fuzzer-patch-test:
F-0010, F-0011, F-0012, F-0013, F-0014, F-0093

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Performance improvement
• Code refactoring
• Test addition or update

Changes Made

• Added a top-level permissions: contents: read block to
  .github/workflows/fuzz.yml.
• Validated workflow_dispatch duration inputs as whole-number seconds before
  they reach shell execution in both the thorough and custom fuzz jobs.
• Validated custom fuzz targets against the allowed target set and routed later
  steps through the validated output instead of the raw dispatch input.
• Quoted the validated fuzz target and duration in the custom fuzz run step.
• Made all fuzz crash-check steps fail explicitly when the expected
  fuzz/artifacts/... directory was never created, instead of silently passing.
• Scoped crash-artifact upload naming and paths to the validated target output.

Testing Performed

Describe the tests you ran to verify your changes:

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• All existing tests pass (cargo test)

Test commands:

git diff --check
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/fuzz.yml"); puts "yaml ok"'
rg -n "github\\.event\\.inputs\\.(duration|target)" .github/workflows/fuzz.yml

Checklist

Before submitting this PR, please ensure:

• Code follows project style guidelines (cargo fmt)
• No clippy warnings (cargo clippy -- -D warnings)
• All tests pass (cargo test)
• Documentation updated (if applicable)
• CHANGELOG.md updated (if applicable)
• No breaking changes (or documented if necessary)
• Commit messages follow conventional commit format

Performance Impact

If this PR affects performance:

• Benchmarks run and results documented
• No significant performance regression
• Performance improvement quantified

Benchmark results:

N/A

Screenshots/Examples

Not applicable.

Additional Notes

This PR intentionally stays scoped to .github/workflows/fuzz.yml. It hardens
the workflow boundary and failure semantics without changing the fuzz targets or
runtime generator behavior.

Breaking Changes

workflow_dispatch now rejects non-numeric duration values and custom
targets outside all_protocols and validate_with_python.