Make fuzz budgets deterministic

[suraciii]

Problem

The final remote master proof for
884351d1b130ece20ede99c300995677ff202f9b failed in hosted run
31499798759.

Linux stable completed 421,658 executions of FuzzParseGrainMarker, then the
Go fuzz coordinator reported context deadline exceeded at the normal
ten-second -fuzztime boundary. No product assertion failed and no failing
corpus entry was written. The matrix then canceled Linux 1.25, and aggregate CI
failed. macOS and Windows passed.

This is the duration-boundary race tracked in
golang/go#75804 and fixed upstream
by golang/go#79199. The fix is not in
the required Go 1.25 or Go 1.26.5 lanes.

Required Change

Use Go's supported fixed-iteration -fuzztime=Nx mode for the release gate.
Set every budget above both the failed hosted run and the earlier successful
ten-second run:

• FuzzReadFrame: 1,600,000 iterations.
• FuzzDecodeRequestContext: 225,000 iterations.
• FuzzParseGrainMarker: 2,250,000 iterations.

Hard-code the budgets in the release commands so caller-provided Make
variables cannot weaken them. Update the design before the Makefile and release
command contract. Preserve real fuzz failures and record the measured basis.

Do not retry, ignore context deadline exceeded, skip fuzzing, reduce coverage,
or weaken the gate.

Acceptance

• The release design states the fixed per-target budgets and why they replace
  wall-clock fuzz deadlines.
• Every budget exceeds the earlier successful execution count.
• make fuzz runs all three seed corpora and reaches every fixed iteration
  budget.
• The fail-closed release-command test requires the exact commands and budgets.
• A real fuzz callback failure remains a command failure.
• make ci and make external pass locally from a cold test cache on the exact
  candidate commit.
• The exact PR head and resulting remote master both pass hosted Linux 1.25,
  Linux stable, macOS, Windows, and aggregate CI.

[suraciii]

Completed on exact master commit
0c41f9f644905183d7d4fd8f7efed24e4396bf0d (tree
237c6417492e5e590f4867acba4f466c62399041) by #119.

Final evidence:

• Local detached worktree was clean.
• Cold-test-cache make external: exit 0 in 34.15 seconds; 20 external tests,
  restart recovery, and exact v0.0.5 upgrade passed.
• Cold-test-cache make ci: exit 0 in 73.37 seconds; 639 default and race
  tests and every required suite passed.
• PR-head run
  31503688931
  passed all five required jobs.
• Exact-master run
  31504300130
  passed Go 1.25.12, Go 1.26.5 stable with govulncheck, macOS, Windows, and
  aggregate ci.
• Both exact-master Linux lanes completed 1,600,000, 225,000, and
  2,250,000 executions. Stable reported no known vulnerabilities.
• The fixed budgets exceed the earlier successful work counts. Caller Make
  variables cannot reduce them, and TestRunKeepsFuzzFailure proves that a
  real fuzz callback failure remains fail-closed.
• The contract-count mutation failed as required and was restored.
• Independent final review found no P0, P1, or P2 issues.

The v0.1.0 tag, make external-tagged, and GitHub Release remain outside
this issue and are still tracked by #109.