chore(git): untrack fuzz/target build artifacts

[h4x0r]

What this is

Index hygiene only. 391 files removed from the git index, zero files removed from disk, no source change.

The diff will render as ~391 deletions. Nothing was deleted — git rm -r --cached drops index entries and leaves the working tree untouched. The only content change in this PR is 4 lines in .gitignore.

The defect

391 cargo build artifacts under fuzz/target/ were tracked in git: .fingerprint/ entries, dep-lib-*, invoked.timestamp, .cargo-*-lock, *.json metadata.

The root .gitignore was the single line /target/ — a leading slash anchors the pattern to the repo root, so it never covered fuzz/target/. (fuzz is a nested cargo package with its own Cargo.toml, outside the workspace members list, so it gets its own build dir.) The fix makes the pattern unanchored so it matches a target/ at any package root.

Why it matters beyond bloat

Tracking these made an ordinary maintenance operation destructive: a routine cargo sweep across the fleet deleted them, because every reasonable tool assumes everything under target/ is regenerable. They were restored with git restore, but the next person running any target/-cleaning tool hits the same trap.

Published crate payload

Not affected. The published packages are core/ (vhd-core) and forensic/ (vhd-forensic); fuzz/ sits outside both, so cargo never sees it — cargo package --list returns 0 target/ entries for each. Consumers were not downloading build fingerprints.

Nothing depended on the tracked state

• grep -rn 'fuzz/target' .github — no matches.
• cargo build --workspace — clean.
• cargo test --workspace — 55 passed, 7 suites.

Verification

$ git ls-files | grep -cE '(^|/)target/'
0

$ git status --porcelain
(empty — clean tree)

$ find fuzz/target -type f | wc -l
391

Note for reviewers with other open PRs

Branched from origin/main. The diff is .gitignore plus index removals under fuzz/target/, so it should not collide with source changes in the other open PRs.

🤖 Generated with Claude Code