Move existing fuzzers to test/fuzz

[alexreinking]

This PR moves the existing fuzz tests that were under test/correctness to test/fuzz, and integrates them into the fuzz test framework from #9050.

Checklist

• Tests added or updated (not required for docs, CI config, or typo fixes)
• Documentation updated (if public API changed)
• Python bindings updated (if public API changed)
• Benchmarks are included here if the change is intended to affect
  performance.
• Commits include AI attribution where applicable (see Code of Conduct)

[mcourteaux]

Why decltype(auto) instead of simply T? What does that even mean? it's already auto? The signature that exists is perfectly fine IMO.

[mcourteaux]

Nice. Why does git not detect the file moves? It's treating it as a full new file.

[alexreinking]

A fuzzing failure:

Seed: 13975354177959516233
can't prove upper bound: ((int8)1 <= (int8)0)
a = (uint32)23
b = (uint32)57
c = (uint32)109
d = (uint32)84
e = (uint32)99
int8x8(select(ramp(int32((uint32)d), -83, 8) <= x2(x4(-4)), ramp(x4(-43), ramp(78, int32((uint32)c), 4), 2), ramp(x4(int32((uint32)a)), ramp(x2(37), x2(int32((uint32)e)), 2), 2)) <= int32x8(x2(ramp(x2((uint32)a), x2((uint32)4294967199), 2))))
[(int8)0, (int8)0]
In vector lane 0:
int8(select(int32((uint32)d) <= -4, -43, int32((uint32)a)) <= int32((uint32)a)) -> (int8)1
scope {
	a : [(uint32)21, (uint32)25]
	b : [(uint32)47, (uint32)90]
	c : [(uint32)109, (uint32)119]
	d : [(uint32)84, (uint32)91]
	e : [(uint32)50, (uint32)114]
}

[alexreinking]

I decided to back out merging the random expression generators between simplify and lossless_cast. It started creeping too far in scope. The simplifier fixes we discovered along the way remain, of course.

[mcourteaux]

LGTM, except one concern regarding simplifying 0 / 0, @abadams.