Expose generated state-prefix layout for libFuzzer custom mutators

[0pendev]

Proposed feature

Absolution currently provides no supported way for LLVMFuzzerCustomMutator to distinguish or interpret the state prefix from the entrypoint payload.

Generate a public C header alongside fuzzer.c containing:

#define ABSOLUTION_STATE_PREFIX_SIZE /* generated */
typedef struct __attribute__((packed)) {
    /* generated state-encoding fields */
} AbsolutionHeader;
_Static_assert(
    sizeof(AbsolutionHeader) == ABSOLUTION_STATE_PREFIX_SIZE,
    "AbsolutionHeader layout mismatch"
);

A custom mutator can include this header and access:

AbsolutionHeader *state = (AbsolutionHeader *)Data;
uint8_t *payload = Data + ABSOLUTION_STATE_PREFIX_SIZE;
size_t payload_size = Size - ABSOLUTION_STATE_PREFIX_SIZE;

Encoding contract

• Unconstrained (top) fields contain their raw input bytes.
• Multi-value, pointer, and whole-value domains contain one-byte selectors.
• Singleton constrained domains consume no bytes and therefore have no member.
• Padding consumes no bytes.
• Arrays and globals preserve the exact ordering currently consumed by sample_invariant().
• Generated member names are deterministic, unique, and traceable to their source global and field.
• Existing corpus encoding remains unchanged.

Acceptance criteria

• Absolution generates a reusable header and makes it available through CMake.
• fuzzer.c and custom mutators use the same generated definition.
• sizeof(AbsolutionHeader) always equals the number of bytes consumed.
• Tests cover unconstrained fields, constrained selectors, arrays, multiple globals, singleton domains, and an empty state prefix.
• An integration test compiles and runs an LLVMFuzzerCustomMutator.
• Documentation explains that custom mutators must preserve at least ABSOLUTION_STATE_PREFIX_SIZE bytes.