feat(fuzz): use minset corpus culling

[decofe]

Summary

• replace mutation-count favorability with top-rated minset culling for coverage-guided corpora
• track coverage indices contributed by corpus entries and favor the cheapest representative per covered edge
• add a bounded per-worker CachedDiskCorpus so evicted non-favored entries leave the hot in-memory corpus but remain available as cached/on-disk mutation donors
• remove the obsolete corpus_min_mutations config and snapshot entries

Prompted by: @0xalpharush

Tests

• cargo check -p foundry-evm
• cargo test -p foundry-evm executors::corpus::tests:: --lib
• cargo test -p forge config::can_show_config --test cli
• cargo test -p forge config::can_set_config_values --test cli
• cargo test -p forge config::test_default_config --test cli

Note: cargo test -p forge config was also attempted, but that broad filter includes unrelated inline/live-log tests that failed locally due solc install snapshot output and a missing local RPC at 127.0.0.1:8545.

[0xalpharush]

derek bench invariant

[github-actions]

cc @0xalpharush

bench (invariant) event published. Results will be reported separately. View publisher run

Config: subcommand: invariant, PR SHA: 29b43f365cf4, compare-ref: master, timeout: 3600s, workers: default, benchmark-type: property

[stevencartavia]

A call's coverage edges are added to current_run.corpus_edges before the pop decision, but (unlike cmp_seq) corpus_edges isn't trimmed when the call is popped (vm.assume discard / reverted-and-dropped calls).

So a popped call's edges end up on the surviving sequence's CorpusEntry and in top_rated, which can then favor a sequence that can't actually reproduce that edge.

I reproduced this with a coverage-guided invariant test (call hits a branch then vm.assume discards it; another call survives) — no pops → clean. It seems to self-heal on restart, so not a blocker, but should we trim corpus_edges on pop to keep minset accuracy correct during a live run?

[figtracer]

lgtm

[mablr]

Should be re-benchmarked (once infra is ready), and de-conflicted.

[grandizzy]

derek bench invariant timeout=300

[github-actions]

cc @grandizzy

bench (invariant) event published. Results will be reported separately. View publisher run

Config: subcommand: invariant, PR SHA: cf3222f2067b, compare-ref: master, timeout: 300s, workers: default, benchmark-type: property

[grandizzy]

derek bench invariant timeout=300

[github-actions]

cc @grandizzy

bench (invariant) event published. Results will be reported separately. View publisher run

Config: subcommand: invariant, PR SHA: cf3222f2067b, compare-ref: master, timeout: 300s, workers: default, benchmark-type: property