ci: add libFuzzer harnesses + valgrind memcheck for the pure parsers

[rizukirr]

Summary

Add libFuzzer harnesses for the three pure parsers (lt__key_decode, lt__color_parse_osc_reply, lt__utf8_decode) plus a valgrind memcheck CI pass over the pure-unit test subset — covering ROADMAP DoD #7 ("fuzzer runs an hour without crashes; valgrind reports no leaks").

Changes

• Fuzz scaffolding + keymap target — LIBTERM_BUILD_FUZZERS CMake option (clang-only, default OFF), tests/fuzz/ subdir, fuzz_keymap harness over the input decoder + seed corpus.
• colorq fuzz target — fuzz_colorq over the OSC color-reply parser + seed corpus.
• utf8 fuzz target — fuzz_utf8 over the UTF-8 decoder + seed corpus.
• Fuzz README — local build/run + crash-reproduction docs.
• Valgrind-safe test labels + suppressions — valgrind_safe CTest label on the 11 pure, non-pty, non-timing tests; minimal tests/valgrind.supp.
• CI fuzz-smoke job — per-PR: build all three targets, replay seed corpora (-runs=0) + a 30s exploratory run; fails on any crash.
• CI valgrind job — per-PR: plain (non-sanitized) Debug build, run the valgrind_safe subset under memcheck (--error-exitcode=1), covering uninitialized-read coverage the existing asan/ubsan job does not.
• Nightly long-fuzz workflow — fuzz-nightly.yml: schedule + dispatch, 3-target matrix, ~20 min/target (~1h combined), uploads crash artifacts.
• Review fixes — widened the colorq seed-selector to a 2-byte form so all 258 what targets are reachable (replay coverage 5→8); broadened valgrind leak-kinds to definite,indirect; added tests/fuzz/.gitignore so libFuzzer-discovered corpus units and crash artifacts are never committed.

Testing

• Default suite unaffected: ctest → 100% tests passed, 0 tests failed out of 34.
• All three fuzzers build under clang and replay their seed corpora exit=0.
• clang-guard: CC=gcc cmake -DLIBTERM_BUILD_FUZZERS=ON → CMake Error … requires clang.
• ctest -L valgrind_safe -N → Total Tests: 11 (none of the excluded pty/timing tests).
• CI YAML (ci.yml fuzz-smoke/valgrind, fuzz-nightly.yml matrix) parses valid.
• Note: the valgrind job's live memcheck run is confirmed only on CI (valgrind not installed in the dev env); fuzz-smoke/nightly likewise first execute on CI.