test(specializer): SPECIALIZER_FUZZ_SEEDS knob for deep fuzz runs

The three generated-program fuzzes (backend contract, determinism, IR
round-trip) had their seed counts hardcoded, so a deep audit meant editing
source and remembering to restore it. Mirrors the regexp fuzzer's existing
REGEXP_FUZZ_N knob; gate depths are unchanged as the defaults.

Verified at depth on master's code, all green, no divergences:
  backend contract  100,000 seeds (default 500)   37s
  determinism        50,000 seeds (default 150)  0.9s
  IR round-trip      50,000 seeds (default 300)  2.5s

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: ahrzb

src/specializer/exec/tests.rs

@@ -878,7 +878,7 @@ fn gen_input(rng: &mut gen::Rng, p: &Program) -> Batch {
 /// meeting iadd, ftoi on inf, ...).
 #[test]
 fn fuzz_generated_programs_execute_deterministically() {
-    for seed in 0..150u64 {
+    for seed in 0..gen::fuzz_seeds(150) {
         let p = gen::gen_program(seed);
         let mut rng = gen::Rng::new(seed ^ 0x9E37_79B9_7F4A_7C15);
         let statics = gen_statics(&mut rng, &p);
@@ -931,7 +931,7 @@ fn casemap_tables_sorted_and_marquee_pins() {
 fn fuzz_cranelift_agrees_with_interpreter() {
     use super::cranelift;
     // More seeds than the determinism fuzz: this is the backend contract.
-    for seed in 0..500u64 {
+    for seed in 0..gen::fuzz_seeds(500) {
         let p = gen::gen_program(seed);
         let mut rng = gen::Rng::new(seed ^ 0x9E37_79B9_7F4A_7C15);
         let statics_i = gen_statics(&mut rng, &p);

src/specializer/ir/gen.rs

@@ -13,6 +13,18 @@ use super::{
     StaticTy, StrOp1, StrOp2, StrOp2i, StrOp3, Term, TrimSide, Ty, Value,
 };
 
+/// Seed count for a fuzz loop: `default` in the gate, overridden by
+/// `SPECIALIZER_FUZZ_SEEDS` for exploratory deep runs. Mirrors the regexp
+/// fuzzer's `REGEXP_FUZZ_N` knob so a deep audit never needs a source edit.
+/// Each seed keys a distinct xorshift stream, so raising this raises coverage
+/// rather than repeating programs.
+pub fn fuzz_seeds(default: u64) -> u64 {
+    match std::env::var("SPECIALIZER_FUZZ_SEEDS") {
+        Ok(s) => s.trim().parse().unwrap_or(default),
+        Err(_) => default,
+    }
+}
+
 pub struct Rng(u64);
 
 impl Rng {

src/specializer/ir/tests.rs

@@ -869,7 +869,7 @@ entry:
 
 #[test]
 fn fuzz_round_trip() {
-    for seed in 0..300u64 {
+    for seed in 0..gen::fuzz_seeds(300) {
         let p = gen::gen_program(seed);
         if let Err(errs) = verify(&p) {
             let msgs: Vec<String> = errs.iter().map(|e| e.to_string()).collect();