refactor(testing)!: move fixtures onto owner types

[sephynox]

Summary

Test material was fifteen loose create_* functions in a module named utils, and the harness read its own state through free functions and hand-rolled cursor arithmetic. A CSP process whose alphabet a run never touched also passed, because a trace that takes no transition satisfies every process.

Related Issues

None

Changes Made

• A CSP process the run never enters now rejects
• Hooks return nothing, so a failing check cannot be swallowed
• schedulability: in tb_assert_spec! compiles at all
• Two AFL targets cover Frame and TransportEnvelope DER
• Frame DER round-trip property under testing-property

Testing

• make test-all: passes

Breaking Changes

• Fixtures moved to owner types:
  • create_test_signing_key() is TestKey::signing().
  • create_v0_tightbeam() is TestFrame::v0().
  • testing::utils is testing::fixtures.
  • verify_trace(spec, trace) is spec.verify(trace).
• Hooks return () and are built with TestHooks::on_pass / TestHooks::on_fail.
  • A hook that used ? becomes an assertion.
• A CSP process that models doing nothing needs ProcessBuilder::permits_no_progress.

---

Note

Medium Risk
Breaking testing and CSP verification behavior can fail downstream scenarios; CSP progress checks change what counts as a pass. New DER fuzz targets exercise untrusted-input boundaries but do not alter production decode logic.

Overview
This PR reorganizes the test harness and tightens a few verification semantics, with breaking changes for anyone using testing APIs.

Fixtures lose the scattered create_* helpers in favor of owner types (TestKey, TestFrame, TestCertificate, TestMessage, TestDigest, …) under testing::fixtures. Call sites across tests, fuzz targets, and consumer crates are updated accordingly.

Scenario grading moves trace checking onto specs (spec.verify(trace) instead of verify_trace), folds the expected pass/fail once into HookContext::outcome(), and reshapes TestHooks into on_pass / on_fail observers that return () (so errors cannot be swallowed with ?).

CSP Layer 2 now defaults to requires_progress: a run that never emits an event in the process alphabet fails with NoProgress unless the process explicitly calls ProcessBuilder::permits_no_progress() (trace-derived processes set requires_progress: false).

Fuzzing adds AFL tb_scenario! { fuzz: afl, raw: ... } targets for Frame::from_der and TransportEnvelope::from_der, centralizes fuzz byte cursor logic in FuzzContextInner, and introduces optional testing-property with proptest in the workspace lockfile.

^{Reviewed by Cursor Bugbot for commit 97ce67d. Bugbot is set up for automated code reviews on this repo. Configure here.}