Add a CI fuzz job covering x86_64 and i686

[kadircanyildirm-crypto]

Closes #39.

Adds a Fuzz job to ci.yml: one leg per target, builds all four fuzz targets and gives each a bounded run. Nothing in CI compiles fuzz/ today (it is excluded from the workspace) and google/oss-fuzz#15870 is still open, so the targets currently have no coverage at all.

Two things were in the way:

• cargo fuzz cannot build for i686 with its default -s address: rustc ships no AddressSanitizer runtime for 32-bit x86 (librustc-*_rt.asan.a). --sanitizer none links fine, so the Makefile now picks the sanitizer from the target, overridable via SPACEWASM_FUZZ_SANITIZER, and the job does the same.
• The i686 leg is the one that catches pointer-width bugs: an earlier run of this job found Malformed module panics the decoder on 32-bit targets: unbounded vector length reaches Layout::array(..).unwrap() #158 (Layout::array panic on a 32-bit usize) in under two minutes. That is fixed by Clean up code-base from external review #189, so the leg is blocking rather than advisory.

Verified on 2eceda3 with cargo-fuzz 0.13.2: all four targets build under ASan (2 min 25 s cold) and run clean for 20 s each (32k to 49k executions per target), on both the current nightly and the one this job pins (nightly-2026-08-30, shared with the Miri job). Actions are pinned to the SHAs ci.yml already uses. The i686 leg was last exercised locally on an earlier revision (Docker, gcc-multilib), so it is worth watching on the first CI run.

AI use per AI_POLICY.md: Claude Code assisted with diagnosing the i686 link failure, drafting the job, the Makefile change and this description. Scope: .github/workflows/ci.yml and Makefile; no src/ change.