ci: fix nightly workflow (4 longstanding failures)

The nightly workflow has failed every run since it was added. Fix the
four distinct issues so it can actually exercise the slow checks:

- cargo-mutants: drop bogus `--in-diff-base ""` flag (never existed in
  cargo-mutants; v27 rejects it).
- fuzz smoke: pin `--target x86_64-unknown-linux-gnu`. Binstall ships a
  musl-static cargo-fuzz binary whose default target inherits its own
  triple, and libfuzzer's sanitizer is incompatible with `crt-static`.
- miri: move multi-module filters after `--`. `cargo test` only accepts
  one TESTNAME positional; libtest accepts multiple substring filters.
- stateright random_large: add `target_state_count(1_000_000)` so the
  simulation actually terminates instead of looping past the 30 min CI
  timeout. The comment already claimed "up to 10⁶ states".

Also refreshes fuzz/Cargo.lock, regenerated by the local verification
build (was stale vs. parent deps).

.github/workflows/nightly.yml

@@ -25,9 +25,11 @@ jobs:
       - name: miri on keys/wire/crypto/merge
         env:
           MIRIFLAGS: -Zmiri-disable-isolation
-        # Quoted because YAML plain scalars can't contain `: ` sequences
-        # without being misparsed as mapping entries.
-        run: "cargo +nightly miri test --lib keys:: wire:: crypto:: merge::"
+        # `cargo test` takes a single TESTNAME positional, so multi-module
+        # filters must be passed to the test binary after `--`. Quoted because
+        # YAML plain scalars can't contain `: ` sequences without being
+        # misparsed as mapping entries.
+        run: "cargo +nightly miri test --lib -- keys:: wire:: crypto:: merge::"
 
   mutants:
     name: cargo-mutants
@@ -43,7 +45,7 @@ jobs:
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-mutants,cargo-nextest
-      - run: cargo mutants --shard ${{ matrix.shard }}/4 --in-diff-base ""
+      - run: cargo mutants --shard ${{ matrix.shard }}/4
 
   fuzz-smoke:
     name: fuzz smoke (60s / target)
@@ -63,7 +65,11 @@ jobs:
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-fuzz
-      - run: cd fuzz && cargo +nightly fuzz run ${{ matrix.target }} -- -max_total_time=60
+      # `--target` is explicit because the binstall'd `cargo-fuzz` binary is a
+      # statically-linked musl build, and `cargo fuzz`'s default target is the
+      # triple it was compiled for. The libfuzzer sanitizer is incompatible
+      # with the static-crt musl target, so force the glibc triple.
+      - run: cd fuzz && cargo +nightly fuzz run --target x86_64-unknown-linux-gnu ${{ matrix.target }} -- -max_total_time=60
 
   kani:
     name: kani

tests/stateright_model.rs

@@ -278,6 +278,7 @@ fn random_large() {
         .checker()
         .threads(num_cpus())
         .target_max_depth(50)
+        .target_state_count(1_000_000)
         .spawn_simulation(0, stateright::UniformChooser)
         .join()
         .assert_properties();