Lean's side of the trusted-base fuzzer

C exports for cairn-fuzz-trusted (host/Tests/CairnFuzzTrusted), the Swift executable that links this library next to the Swift host, so both sides of each trusted boundary run in one process (docs/fuzz.md, "Trusted base"). No import Lean: this links into a Swift binary.

• cairn_tf_gen_frame seed: a random frame (Gen.frame), encoded.
• cairn_tf_decode_frame bytes and cairn_tf_decode_events bytes: Lean's proved decoders' verdict on any bytes. The reply is "R" (rejected), or "A=" / "A~" (accepted; = when re-encoding the value gives the same bytes back) followed by the canonical dump (Cairn.Dump), which the Swift side compares with its own dump.
• cairn_tf_field_init/step/frame: an app that is one text field, on the real runtime and boundary (Runtime.stepBytes, Frame.boundary, TextMetrics.host), so the host's NSTextInputClient and its shadow of the field can be checked against Field.apply. The same ABI as cairn_app_* (docs/runtime.md), under other names so it can't clash.
• cairn_tf_wrap: where Lean breaks a string into lines at a width with TextMetrics.host, and where layout puts each line, so the Swift side can shape each line as the renderer will and compare with Core Text's own line breaking.