Fix the weekly fuzz runs and the BESL leaks they found

[facundo-villa]

Requested by Facundo · project thread

Before: every job in the first scheduled Fuzz BESL and Fuzz BETP runs failed in about 2 seconds with sanitizer is incompatible with statically linked libc, before any fuzzing happened. The fuzz workflows rebuilt every dependency each run. Once fuzzing ran, the BESL compile target reported memory leaks for main: fn () -> root {}, recursive functions, and vec3f(main) inside main.

After: the fuzz targets build for x86_64-unknown-linux-gnu and fuzz normally, with a cached build. All three leaking inputs compile without leaking. Recursion still links. A type name that isn't a type, and a function used as a value, are now lexer errors.

How:

• Build target. taiki-e/install-action falls back to cargo-binstall, which installs the prebuilt musl cargo-fuzz. cargo-fuzz defaults --target to its own triple, and AddressSanitizer can't link static musl libc. Both workflows pass --target x86_64-unknown-linux-gnu.
• Build cache. Each fuzz job caches the Cargo registry and its fuzz target directory with actions/cache (backed by Blacksmith), keyed on the fuzz workspace's Cargo.lock, like rust.yml.
• Type names. resolve_type accepted any named node, so -> root made main hold its own ancestor. It now accepts only Struct declarations.
• Weak call references (breaking). Expressions::FunctionCall::function is now a CallTarget. It holds a Weak reference to Function nodes and a strong one to anything else, such as type constructors and on-demand array types the call may solely own. Read it with CallTarget::get(). The program tree now owns every function, so keep the program alive while you use its main. The test fixtures that returned main and dropped the program now return the program.
• Functions as values. A bare function name in value position is now LexError::Undefined, because it formed the same cycle.

Validation: byte-engine-besl has 219 lib tests, and byte-engine-resource-management has 628 lib and 12 integration tests; all pass. New lexer tests cover non-type names, functions as values, and recursive calls. cargo fmt --check reports no new diffs. Each saved leak input runs clean under ASan.

Known remaining: a 5-minute local compile fuzz run found a parser timeout, not a leak. A 269-byte input of deeply nested unbalanced calls takes about 6 seconds to parse under ASan. It is in the parser, which this PR doesn't touch.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BYDnECscGCTZr5M5upFEMs

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T19:30:29.868598Z	918a310	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.