A tier-differential fuzzer finds five live wrong-answer classes

Running the same programs through the interpreter and every JIT tier and diffing the outputs finds five classes of silent wrong answers.

The engine had already learned this lesson once in June, when an adversarial audit of the JIT found six soundness bugs, and again on 13 June when "the INT tier was silently returning wrong answers on ordinary loops -- a dense-array tag check scratched a live Bool home register". ee14c71d makes the check systematic: a fuzzer that runs generated programs in every tier and diffs the results, which found five more classes. A later commit found that "the operand table was blind to 185 of 221 opcodes -- 23 wrong-answer shapes, one root cause".