fix(ci): repair nightly CI and add fuzz compile guard

.github/workflows/ci.yml

@@ -121,19 +121,39 @@ jobs:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
         run: cargo run --example agent_tool --features http_client
 
+  fuzz-check:
+    name: Fuzz Compile Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Rust nightly
+        uses: dtolnay/rust-toolchain@nightly
+
+      - name: Install cargo-fuzz
+        uses: taiki-e/cache-cargo-install-action@v3
+        with:
+          tool: cargo-fuzz
+          locked: true
+
+      - name: Verify fuzz targets compile
+        working-directory: crates/bashkit
+        run: cargo +nightly fuzz build
+
   # Gate job for branch protection — name must stay "Check"
   check:
     name: Check
     if: always()
-    needs: [lint, audit, test, examples]
+    needs: [lint, audit, test, examples, fuzz-check]
     runs-on: ubuntu-latest
     steps:
       - name: Verify all jobs passed
         run: |
           if [[ "${{ needs.lint.result }}" != "success" ]] || \
              [[ "${{ needs.audit.result }}" != "success" ]] || \
              [[ "${{ needs.test.result }}" != "success" ]] || \
-             [[ "${{ needs.examples.result }}" != "success" ]]; then
+             [[ "${{ needs.examples.result }}" != "success" ]] || \
+             [[ "${{ needs.fuzz-check.result }}" != "success" ]]; then
             echo "One or more required jobs failed"
             exit 1
           fi

crates/bashkit/Cargo.toml

@@ -61,7 +61,7 @@ base64 = { workspace = true, optional = true }
 tracing = { workspace = true, optional = true }
 
 # Embedded Python interpreter (optional)
-monty = { git = "https://github.com/pydantic/monty", version = "0.0.7", optional = true }
+monty = { git = "https://github.com/pydantic/monty", tag = "v0.0.7", optional = true }
 
 [features]
 default = []

crates/bashkit/fuzz/.gitignore

@@ -0,0 +1,7 @@
+# Fuzz artifacts and corpus (large, machine-generated)
+target/
+corpus/
+artifacts/
+
+# Override root .gitignore: commit Cargo.lock for reproducible fuzz builds
+!Cargo.lock