Harden fuzz-target registry drift test fidelity

[the-sarge]

Source

Follow-up from RAS review run 20260702T161657-1e0c4eb6fa59325c8e52da1a on PR #207.

The review synthesis found no merge-blocking issues. These are low/nit robustness improvements for the new fuzz-target registry drift test itself, filed separately per the PR review low/nit policy.

Work

• Reject trailing JSON values in .github/fuzz-targets.json by checking for EOF after the first json.Decoder.Decode.
• Ignore receiver methods when discovering func FuzzXxx(f *testing.F) targets.
• Tolerate legal trailing comments on the go.mod module line by accepting len(fields) >= 2.
• Normalize ossfuzz/build.sh comparison on parsed fields so cosmetic whitespace does not fail the test.
• Keep registry/build ordering strict, but document that invariant near the compile_native_go_fuzzer block.
• Mirror Go's Fuzz<non-lowercase> naming rule instead of a plain strings.HasPrefix("Fuzz") check.
• Either honor build constraints during discovery or document that all package fuzz targets must remain unconstrained.
• Either resolve aliased testing imports or document that fuzz targets must use the unaliased testing import.

Out of scope

Do not change production package behavior. Do not refresh release evidence unless this work later makes a stronger release-readiness claim.