ci: migrate miri and fuzz testing to circleci-toolkit orb (#1499)

## Summary

This PR migrates the custom miri and fuzz testing jobs to the new
reusable orb jobs available in circleci-toolkit@3.3.0.

## Changes

### Before (72 lines)
- Custom `miri_tests` job with inline bash scripts
- Custom `fuzz_smoke` job with manual tool installation
- No caching optimization
- Maintenance burden for each project

### After (42 lines)
- Declarative `toolkit/rust_miri` job
- Declarative `toolkit/rust_fuzz_smoke` job  
- Automatic caching with better performance
- Centralized maintenance in toolkit orb
- **42% code reduction** (30 lines removed)

## Migration Details

**Miri Job:**
- ✅ Same MIRI flags: `-Zmiri-disable-isolation`
- ✅ Same package selection: `-p hcaptcha`
- ✅ Same test arguments: `--lib`
- ✅ Same skip patterns: All 7 tests skipped as before
- ✅ Enhanced: Automatic caching for faster runs

**Fuzz Job:**
- ✅ Same target: `response_parse`
- ✅ Same duration: 60 seconds
- ✅ Same behavior: Doesn't fail build on findings
- ✅ Enhanced: Automatic artifact storage
- ✅ Enhanced: Caching of cargo-fuzz installation

## Test Plan

- [ ] Verify miri_tests job runs successfully
- [ ] Verify same tests are skipped as before
- [ ] Verify fuzz_smoke job runs successfully
- [ ] Verify no functionality regression
- [ ] Check cache performance on second run

## Benefits

1. **Less Code**: 42% reduction in configuration
2. **Better Caching**: Automatic optimization for faster CI runs
3. **Easier Maintenance**: Updates managed in toolkit orb
4. **More Features**: Built-in artifact storage, better error messages
5. **Consistency**: Same pattern across all jerus-org projects

## Related

- Toolkit PR: digital-prstv/circleci-toolkit#264
- Toolkit version: 3.3.0
- Part of the miri-fuzz-to-toolkit migration initiative

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: jerusdp

.circleci/audit.yml

@@ -5,67 +5,37 @@
 version: 2.1
 
 orbs:
-  toolkit: jerus-org/circleci-toolkit@3.2.0
+  toolkit: jerus-org/circleci-toolkit@3.3.0
 
 parameters:
   min-rust-version:
     type: string
     default: "1.88"
 
-jobs:
-  miri_tests:
-    executor:
-      name: toolkit/rust_env
-      min_rust_version: <<parameters.min_rust_version>>
-
-    parameters:
-      min_rust_version:
-        type: string
-        description: "Required: The minimum version of the rust compiler to use"
-
-    steps:
-      - checkout
-      # - run: rustup toolchain install nightly --profile minimal
-      - run: rustup +nightly component add miri
-      - run: |
-          set -eux
-          # Allow std time/syscalls while still catching UB in Rust code
-          export MIRIFLAGS="-Zmiri-disable-isolation"
-          # Limit to core crate to keep runtime bounded
-          cargo +nightly miri test -p hcaptcha --lib -- \
-            --skip hcaptcha_mock_verify \
-            --skip hcaptcha_mock_verify_request_reuse \
-            --skip hcaptcha_mock_verify_not_found \
-            --skip hcaptcha_mock_verify_client_response \
-            --skip hcaptcha_mock_verify_client_response_not_found \
-            --skip hcaptcha_mock_with_remoteip \
-            --skip hcaptcha_mock_with_sitekey
-
-  fuzz_smoke:
-    executor:
-      name: toolkit/rust_env
-      min_rust_version: <<parameters.min_rust_version>>
-
-    parameters:
-      min_rust_version:
-        type: string
-        description: "Required: The minimum version of the rust compiler to use"
-
-    steps:
-      - checkout
-      # - run: rustup toolchain install nightly --profile minimal
-      - run: cargo +nightly install cargo-fuzz
-      - run: |
-          set -eux
-          # Short fuzz smoke (60s) on the response parser target
-          cargo +nightly fuzz run response_parse -runs=0 -max_total_time=60 || true
-
 workflows:
   audit:
     jobs:
       - toolkit/security:
           sonarcloud: false
-      - miri_tests:
+
+      - toolkit/rust_miri:
+          name: miri_tests
           min_rust_version: << pipeline.parameters.min-rust-version >>
-      - fuzz_smoke:
+          package: "hcaptcha"
+          test_args: "--lib"
+          skip_tests: >
+            hcaptcha_mock_verify
+            hcaptcha_mock_verify_request_reuse
+            hcaptcha_mock_verify_not_found
+            hcaptcha_mock_verify_client_response
+            hcaptcha_mock_verify_client_response_not_found
+            hcaptcha_mock_with_remoteip
+            hcaptcha_mock_with_sitekey
+          miri_flags: "-Zmiri-disable-isolation"
+
+      - toolkit/rust_fuzz_smoke:
+          name: fuzz_smoke
           min_rust_version: << pipeline.parameters.min-rust-version >>
+          fuzz_target: "response_parse"
+          max_total_time: 60
+          fail_on_findings: false