ci: fix deep-fuzz workflow (engine-arg parsing + nightly toolchain)

[joeldsouzax]

Summary

The scheduled deep-fuzz workflow had been failing on every target — it never actually fuzzed. Two independent bugs, both fixed here:

1. Engine-arg parsing. cargo bolero test … -E -max_total_time=120 — cargo-bolero 0.13.4's clap parser reads the value -max_total_time (leading dash) as bundled short flags and rejects -m (error: Found argument '-m' which wasn't expected). Fix: attach the value to -E with = → -E=-max_total_time=120. Also pin cargo-bolero to the bolero lib's 0.13.x series so a --force install can't pull a future release with an incompatible CLI.
2. Nightly toolchain shadowing. Once args parsed, the build failed with the option 'Z' is only accepted on the nightly compiler: the repo's rust-toolchain.toml pins stable 1.95.0, which shadows the nightly the workflow installs, so -Zsanitizer=address was rejected. Fix: set RUSTUP_TOOLCHAIN: nightly on the fuzz step (outranks rust-toolchain.toml).

Verification (real CI, workflow_dispatch on this branch, 30s/target)

• Before: 0/13 targets ran (arg parse error on all).
• After fix 1: past parsing → nightly error on all.
• After fix 2: 12/13 targets green. The 13th (matter_from_qb64) now correctly surfaced a real parser panic (libFuzzer: deadly signal, input 5BAA) — i.e. the workflow is working as intended. That parser bug (matter/builder.rs slice-OOB on malformed qb64) is a pre-existing main defect being fixed separately in feat(#69)!: type-unified, composable signature verification #72/refactor(#33)!: replace terrors::OneOf with domain error enums #74's error-refactor branch — it is not a workflow defect and does not block this PR.

Note: deep-fuzz is schedule + workflow_dispatch only, so it does not run on PR pushes and won't gate this PR's checks.

Test plan

• actionlint clean (pre-commit hook + gate)
• nix flake check green (pre-push hook)
• workflow_dispatch run on this branch: 12/13 targets pass; the 1 failure is a genuine fuzz-found parser bug, tracked separately

🤖 Generated with Claude Code

[codspeed-hq]

Merging this PR will not alter performance

✅ 21 untouched benchmarks

---

_{Comparing fix/deep-fuzz-bolero-cli (43dae76) with main (a475ca9)}