test: add Rust and JS differential fuzzing

[zxch3n]

Summary

• add a shared differential fuzz harness for native Rust, Rust/WASM, and the pure TypeScript runtime
• persist deterministic regression corpus cases for transport, checkout, tree, event, UTF-16, and malformed-import behavior
• align Rust and TypeScript tree deletion, snapshot ordering, event frontiers, map events, and concurrent tree reindex semantics
• document the stable/strict fuzz profiles and add the interoperability smoke command to CI

Why

The pure TypeScript runtime must remain semantically interchangeable with Rust across updates, snapshots, checkout, events, and malformed inputs. Differential fuzzing exposed cases where final state, tree metadata, or event payloads diverged even though ordinary examples passed.

Root causes

• Rust tree snapshot decoding assumed canonical sibling traversal order.
• Event hint RLE and merged operation RLE could split at different UTF-16 boundaries.
• State-neutral imports advanced document versions without advancing event frontiers.
• The TypeScript runtime did not preserve Rust's deleted-tree sentinel, positions, last-move metadata, or all concurrent reindex/event transitions.
• Fuzz event normalization queried live document state at callback time, where WASM and TypeScript callbacks occur at different internal boundaries.

Impact

This improves Rust/WASM/TypeScript parity, preserves deleted tree state across snapshots and checkouts, and makes event behavior consistent for downstream consumers. The permanent corpus keeps the discovered edge cases covered.

Validation

• cargo fmt --all -- --check
• cargo test -p loro-internal local_event_starts_after_net_empty_import
• cargo test -p loro-internal tree_fast_snapshot_accepts_noncanonical_sibling_order
• cargo test -p loro-internal --features wasm txn_events_split_merged_utf16_delete_ops
• pnpm --filter loro-js lint
• pnpm --dir loro-js typecheck
• pnpm --filter loro-js test — 240 tests
• pnpm --filter loro-js build
• pnpm --filter loro-js fuzz:interop -- --corpus-only — 19 corpus cases, 32 malformed-import cases
• pnpm --filter loro-js fuzz:interop:native — 19 corpus cases, 32 malformed-import cases

Stack

This PR targets perf/loro-js-c1-snapshot-import. It should be retargeted to main after the performance branch lands.

The final diff excludes generated JavaScript. The temporary add/remove generated-file commits can be squashed before marking the PR ready for review.