QA: fuzzers, benchmarks, coverage, property-based tests

Add quality assurance infrastructure:
- **Fuzzers**: for parser and type checker to find edge cases
- **Benchmarks**: expand coverage beyond current `test/bench.lq`
- **Coverage**: track test coverage metrics
- **Property-based tests**: QuickCheck-style testing for core components