Add launch hardening gates

.github/workflows/ci.yml

@@ -3,6 +3,9 @@ name: ci
 on:
   push:
   pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 7 * * 1"
 
 jobs:
   test:
@@ -36,17 +39,11 @@ jobs:
         if: steps.nightly.outcome == 'success' && steps.install.outcome == 'success'
         run: |
           set -e
-          for target in \
-            packet_decode \
-            from_body \
-            authorized_keys \
-            known_hosts \
-            handshake_structs \
-            attach_ticket; do
-            echo "== fuzzing $target =="
-            cargo +nightly fuzz run --fuzz-dir fuzz "$target" -- \
-              -max_total_time=20 -rss_limit_mb=4096
-          done
+          if [ "${{ github.event_name }}" = "schedule" ] || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            DOSH_FUZZ_SECONDS="${DOSH_FUZZ_SECONDS:-300}" sh scripts/fuzz-run.sh
+          else
+            sh scripts/fuzz-run.sh 20
+          fi
       - name: Note when fuzzing was skipped
         if: steps.nightly.outcome != 'success' || steps.install.outcome != 'success'
         run: echo "cargo-fuzz / nightly toolchain unavailable; skipped fuzz smoke run."