Inter-worker message bus and per-function call sampling

[elopez]

Why

Workers can currently communicate in exactly one direction: each pushes events
onto the campaign's event queue, which the UI and the listener read. Nothing can
talk back to a running worker, and no worker can tell another one what it just
learned. Every remaining piece of #1502 needs that channel, so it lands here
together with the first thing that uses it.

What

feat: sample per-function call statistics

A worker can be asked to watch a handful of functions and keep, for each, how
often it was called, how often the call did not return successfully, the range
its return value spanned, and a short tail of revert summaries — what an outside
observer needs to answer "is this function reachable, and what does it do when
it is" without reading the corpus.

The state hangs off WorkerState.sampledFunctions, keyed by canonical
signature. The per-event algebra is factored out of the worker into
Types/Campaign.hs (applySampleEvent, abiCompare, mergeSampleStats) so it
is pure and unit-testable; updateSampleStats in Worker/Sequence.hs is left
with just decode-and-dispatch. Tests.Sample covers all three, 25 cases.

feat: add an inter-worker message bus

Env gains a broadcast STM channel alongside the event queue. Readers take
their own dupTChan, so a message reaches every reader instead of being raced
for by whoever gets there first. Echidna.Types.InterWorker holds the protocol.

Two users: callseq broadcasts NewCoverageInfo when a sequence finds
coverage, carrying the sequence and whether it came from replaying the corpus
(the new argument threaded through callseq's callers); and a fuzzing worker
checks the bus once per loop iteration for commands addressed to it, which is
how sampling is turned on and off.

Notes for review

• Nothing enables sampling yet, and nothing listens for NewCoverageInfo
  yet. Both clients are the MCP server, two rungs up. Tests.Sample is the
  entry point for the sampling algebra in the meantime. The two commands land
  here rather than with their sender because they are what makes the bus worth
  having.
• The rest of the upstream protocol is left out. Symbolic commands,
  request/response, and the other broadcasts have neither a sender nor a reader
  on dev-agents-3; each comes back with the code that uses it. (WorkerStopped
  also collided with Types.Worker.WorkerEvent's constructor of the same name.)
• checkMessages drains its queue rather than handling one message per
  iteration. Every broadcast is copied into every worker's duplicate, so with
  N workers a worker receives roughly N messages per iteration; consuming one
  would let the queue grow without bound during the early phase of a campaign,
  when almost every sequence finds new coverage. Commands originate outside the
  campaign at human pace, so draining cannot starve fuzzing.
• The broadcast's sender is resolved through workerIDToType, the same way
  pushWorkerEvent decides which worker type to attribute an event to. The
  symbolic worker calls callseq too, and it is not a fuzzer.
• The strictness in SampleStats is load-bearing and was not free. These
  fields are updated on the fuzzing hot path and only read when a client asks,
  so take n (new : old) would keep old alive through its unevaluated tail
  and old its predecessor — the list capped at five entries would have
  retained the entire revert history. Hence takeStrict, and the forced tuple
  components in the range update.
• The command handler lives in its own module rather than another where-block
  inside runFuzzWorker, matching what the preceding decomposition was aiming
  for and giving the handlers in later rungs a home.

Verification

• cabal build all and cabal build tests clean under -Wall -Wunused-packages
• cabal run tests — all 190 pass, symbolic tests included, so both a normal
  fuzzing run and a symbolic run still terminate
• hlint lib src — clean (one pre-existing hint in SourceMapping.hs, untouched
  here)
• Driven end-to-end with a throwaway probe standing in for the MCP client: a
  ToFuzzer 0 (EnableSampling "bump(uint256)") written by any worker reached
  worker 0 through its duplicate, workers 1–3 correctly ignored it, and worker 0
  reported sampleCalls = 2526, sampleReverts = 1603 with a widened return
  range and exactly maxRecentReverts summaries retained.