ci(cflite): add the Dockerfile ClusterFuzzLite needs and fix the fuzz build

.clusterfuzzlite/Containerfile

@@ -2,7 +2,16 @@
 # ClusterFuzzLite build environment for bunsenite
 FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:73c1d5648db54100639339d411a5d192cbc8bf413ee91e843a07cf6f0e319dc7
 
-COPY . $SRC/bunsenite
+# Copy only what the fuzz build reads, not the whole checkout: the crate
+# manifest and lockfile, its sources and declared benches, the patched
+# nickel-lang-vector crate, the fuzz crate, and this directory (build.sh
+# reads per-target .options files from it).
+COPY Cargo.toml Cargo.lock $SRC/bunsenite/
+COPY src $SRC/bunsenite/src
+COPY benches $SRC/bunsenite/benches
+COPY crates $SRC/bunsenite/crates
+COPY fuzz $SRC/bunsenite/fuzz
+COPY .clusterfuzzlite $SRC/bunsenite/.clusterfuzzlite
 WORKDIR $SRC/bunsenite
 
 COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: MPL-2.0
+# ClusterFuzzLite build image for bunsenite.
+#
+# ClusterFuzzLite invokes `docker build -f .clusterfuzzlite/Dockerfile`,
+# so this file must be named `Dockerfile`. It mirrors the OCI-neutral
+# Containerfile in this directory (kept for podman-first local builds per
+# the authority stack); keep the two in sync.
+FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:73c1d5648db54100639339d411a5d192cbc8bf413ee91e843a07cf6f0e319dc7
+
+# Copy only what the fuzz build reads, not the whole checkout: the crate
+# manifest and lockfile, its sources and declared benches, the patched
+# nickel-lang-vector crate, the fuzz crate, and this directory (build.sh
+# reads per-target .options files from it).
+COPY Cargo.toml Cargo.lock $SRC/bunsenite/
+COPY src $SRC/bunsenite/src
+COPY benches $SRC/bunsenite/benches
+COPY crates $SRC/bunsenite/crates
+COPY fuzz $SRC/bunsenite/fuzz
+COPY .clusterfuzzlite $SRC/bunsenite/.clusterfuzzlite
+WORKDIR $SRC/bunsenite
+
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -9,5 +9,8 @@ cargo +nightly fuzz build
 
 # Copy fuzz targets to $OUT
 for target in $(cargo +nightly fuzz list); do
-    cp ./target/x86_64-unknown-linux-gnu/release/$target $OUT/
+    cp ./fuzz/target/x86_64-unknown-linux-gnu/release/$target $OUT/
+    if [[ -f .clusterfuzzlite/$target.options ]]; then
+        cp .clusterfuzzlite/$target.options $OUT/
+    fi
 done

.clusterfuzzlite/fuzz_parser.options

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: MPL-2.0
+# Runtime options for the fuzz_parser target. build.sh copies this file to
+# $OUT next to the binary, where the ClusterFuzzLite runner picks it up.
+#
+# Leak detection is off because nickel-lang-parser allocates AST nodes in a
+# bumpalo arena, which never runs destructors. Strings held by those nodes
+# therefore leak by design, on every input, including a single newline.
+# Without this, every run reports that upstream leak as a crash and no real
+# finding can surface. Memory-safety errors (overflows, use-after-free) are
+# still reported by AddressSanitizer.
+[libfuzzer]
+detect_leaks = 0
+
+[asan]
+detect_leaks = 0

config/build.k9.ncl

@@ -1,10 +1,11 @@
-# SPDX-License-Identifier: MPL-2.0
 K9!
+# SPDX-License-Identifier: MPL-2.0
 leash = 'Yard  # Validation only, no I/O
 
 pedigree = {
   schema_version = "1.0.0",
   component_type = "rust-build-config",
+  name = "bunsenite-build-config",
   tool = "bunsenite",
   validation_level = "strict",
   description = "Self-validating Cargo build configuration for Bunsenite"

config/rust-fmt.k9.ncl

@@ -1,10 +1,11 @@
-# SPDX-License-Identifier: MPL-2.0
 K9!
+# SPDX-License-Identifier: MPL-2.0
 leash = 'Yard  # Validation only, no I/O
 
 pedigree = {
   schema_version = "1.0.0",
   component_type = "rust-formatter-config",
+  name = "bunsenite-rust-fmt-config",
   tool = "bunsenite",
   validation_level = "strict",
   description = "Self-validating Rust formatter configuration for Bunsenite"

setup-dev-env.k9.ncl

@@ -11,6 +11,7 @@ leash = 'Hunt
 pedigree = {
   schema_version = "1.0.0",
   component_type = "dev-env-setup",
+  signature_required = true,
   author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
   description = "Automated development environment setup for Bunsenite",
   created = "2026-01-30",