Set up automated contract fuzz testing pipeline

[TUPM96]

Closes #438

Summary

• Added a cargo-fuzz package under contracts/fuzz with subscription lifecycle, pricing, and rate-limit fuzz targets.
• Built the fuzz harness against the real Soroban proxy, storage, token, and subscription contracts with seed corpora and invariant checks.
• Replaced the fuzz CI workflow with nightly cargo-fuzz, 1800-second runs per target, scheduled/manual triggers, corpus generation, and artifact upload.
• Added crash triage docs/script plus a deterministic subscription smoke replay test.

Validation

• cargo +nightly test --manifest-path contracts/subscription/Cargo.toml --test fuzz_smoke -- --nocapture
• cargo +nightly fuzz list
• cargo check --manifest-path contracts/fuzz/Cargo.toml --bins
• git diff --cached --check

Note: existing subscription gas modules still emit warnings; this PR leaves those pre-existing warnings untouched.