[mitchellnemitz]

Adds a local-only cross-shell differential fuzzer for the wisp compiler. It defends the byte-identity invariant that hand-authored golden fixtures cannot exhaustively cover: hunting programs whose emitted shell behaves differently across dash, busybox ash, bash, and zsh.

New package internal/fuzz plus a cmd/wisp-fuzz CLI. Go stdlib only, and deliberately never wired into CI (it is a local/nightly soak job, run by hand).

How it works:

• Type-directed AST generation builds well-typed programs by construction, then pretty-prints them, so nearly everything compiles. Entropy is spent payload-centric: on the adversarial values flowing through a program (embedded $(...), newlines, %s, backslashes, leading -, glob metacharacters, arithmetic edge values), where cross-shell bugs actually live.
• v1 scope is the pure core: arithmetic, bool, string, int, float, arrays, dicts, control flow, and non-effectful builtins (93 across 10 families). All effectful/nondeterministic surface is excluded from the generator.
• Two oracles: the four shells must agree on raw stdout bytes and exit status, and the same source must recompile to byte-identical output (a recompile-stability self-oracle). INSTABILITY and DIVERGENCE are reported distinctly.
• On a divergence, an AST-level type-preserving shrinker reduces to a 1-minimal reproducer, persisted with deterministic provenance for replay.
• Runs are deterministic: a fixed seed reproduces a run exactly, so found bugs replay from a committed regression corpus.

Design B, one documented carve-out: the generator deliberately emits INT_MIN, and the oracle carves zsh for the single INT_MIN-in-$(( )) case (a documented, source-cited zsh limitation, not a wisp bug). The carve is a narrow source-level data-flow check (INT_MIN reaching an arithmetic operand via variable flow); it is not widened to arith-lowering builtins, so it cannot mask a real divergence. Reverting the INT_MIN compiler fix makes the fuzzer produce a failing reproducer.

Built task-by-task with a review gate after each and a final whole-branch review. go test ./... is green. Four-shell tests are behind a fuzzshell build tag, so the default go test spawns no shells; exercising the fuzzer end-to-end needs all four shells installed (busybox included).