Add agentic fuzzer to CI as regression gate

[PLNech]

Context

The fuzzer (scripts/fuzz-rtk.py) currently runs manually. After the agentic fuzzing lab week experiment, we have 139 static tests across 35 families that catch real regressions.

Proposal

Add a CI job that runs python3 scripts/fuzz-rtk.py --rounds 0 (static tests only, no LLM) on every PR. Fail if FAIL count exceeds a threshold (currently 22 - all classified as by-design or known limitations).

Requirements

• Docker available in CI (for docker ps/images tests) or skip those families
• Python 3.10+ for the fuzzer script
• rtk binary built from PR branch
• Threshold stored in a config file so it can be tightened over time

Current baseline

• 139 tests, 95 PASS, 12 WARN, 22 FAIL, 10 SKIP
• Failure rate: 15.8% (all classified)

[PLNech]

Keeping open. The agentic fuzzer tooling from #12 (now closed/superseded by the v0.42.0 realign) lives in non-conflicting paths and will be rebased onto v0.42.0 as a standalone PR, then re-baselined against the new command surface (its static tests encode the old surface) before we wire it into CI as a regression gate. This issue tracks that CI integration.