Add isolated harnesses to standard checks

Author: eldryoth

CHANGELOG.md

@@ -78,6 +78,9 @@
   caller-owned buffers without switching to the diagnostic decoder.
 - Added `Engine::ct_decoder()` for explicit promotion to the matching
   constant-time-oriented decoder without type annotations.
+- Added isolated dudect, fuzz, and performance harness compile/dependency
+  checks to the standard local gate so harness policy is verified before
+  release-only evidence steps.
 - Added checked stream adapter `try_into_inner()` helpers that recover the
   wrapped reader or writer only when doing so will not discard pending input or
   buffered output.

README.md

@@ -665,6 +665,9 @@ Run the standard gate:
 scripts/checks.sh
 ```
 
+The standard gate includes isolated dudect, fuzz, and performance harness
+compile/dependency checks. It does not run fuzz campaigns or benchmarks.
+
 Check the zero-external-crate policy directly:
 
 ```sh
@@ -727,7 +730,7 @@ cargo fuzz --version
 cargo kani --version
 ```
 
-Compile fuzz targets without running a campaign:
+Compile and audit fuzz targets directly while iterating on fuzz harnesses:
 
 ```sh
 scripts/check_fuzz.sh
@@ -739,7 +742,7 @@ Validate the committed fuzz corpus policy directly:
 scripts/check_fuzz_corpus.sh
 ```
 
-Compile and audit the isolated performance harness:
+Compile and audit the isolated performance harness directly:
 
 ```sh
 scripts/check_perf.sh

docs/RELEASE.md

@@ -127,7 +127,9 @@ Kani bundles its own Rust compiler. If that compiler is older than this crate's
 `rust-version`, `scripts/check_kani.sh` records an explicit skip until a newer
 Kani release supports the pinned toolchain.
 
-The local release gate runs:
+The standard local gate runs isolated dudect, fuzz, and performance harness
+compile/dependency checks without running timing campaigns, fuzz campaigns, or
+benchmarks. The local release gate also runs:
 
 ```sh
 scripts/check_miri.sh
@@ -156,7 +158,8 @@ The published crate package includes the core release/check scripts, Rust
 toolchain pin, and cargo-deny policy so the documented gate can be inspected
 with the packaged source.
 
-Fuzz-only dependencies are checked separately with:
+Fuzz-only dependencies are included in the standard local gate and can also be
+checked directly with:
 
 ```sh
 scripts/check_fuzz.sh

docs/RELEASE_EVIDENCE.md

@@ -61,7 +61,8 @@ The release gate runs:
 - fuzz target compile check when `cargo-fuzz` is installed
 - fuzz corpus policy validation for target-specific reviewed corpus inputs and
   release-blocking artifact cleanup
-- isolated fuzz and performance harness dependency checks
+- isolated dudect, fuzz, and performance harness dependency checks as part of
+  the standard gate
 - installed-target `no_std` checks for the reserved `simd` feature
 - no-alloc portability smoke crate checks for stack-backed encode/decode,
   wrapped output, URL-safe no-padding, and constant-time-oriented decode with

scripts/checks.sh

@@ -34,6 +34,12 @@ scripts/validate-constant-time-policy.sh
 echo "checks: dudect timing harness"
 scripts/check_dudect.sh
 
+echo "checks: fuzz harness"
+scripts/check_fuzz.sh
+
+echo "checks: performance harness"
+scripts/check_perf.sh
+
 echo "checks: clippy default"
 cargo clippy --all-targets -- -D warnings
 

scripts/stable_release_gate.sh

@@ -45,14 +45,7 @@ else
     echo "stable release gate: skipping fuzz compile check; cargo fuzz or fuzz/ is not available"
 fi
 
-echo "stable release gate: fuzz dependency checks"
-scripts/check_fuzz.sh
-
-echo "stable release gate: performance harness dependency checks"
-scripts/check_perf.sh
-
-echo "stable release gate: dudect timing harness dependency checks"
-scripts/check_dudect.sh
+echo "stable release gate: isolated dudect/fuzz/performance harness checks covered by standard checks"
 
 echo "stable release gate: installed cross-target checks"
 scripts/check_targets.sh