…alues (#3245)

OpenSSF Scorecard's Fuzzing check scores 0 for this repo. Its detection
only checks for `import atheris` (or a ClusterFuzzLite/OSS-Fuzz setup)
anywhere in the tree, so this adds a real target rather than a token
import that would move the number without doing anything.

`NushellActivator.quote` and `PowerShellActivator.quote` are hand-rolled
escaping schemes over arbitrary strings pulled from paths and prompts:
Nushell counts the longest run of `#` and wraps in one more than that,
PowerShell doubles single quotes. Both take untrusted-shaped input, and
a broken escape is a correctness bug worth catching, not just a lint
target. Each harness in `tasks/fuzz_*.py` recomputes the expected output
from the escaping rule on its own and asserts equality against the real
function, so it fails on any scheme violation, not only on a crash. I
ran both assertions against 200k+ randomized adversarial strings
(embedded quotes, `#` runs, control characters, Unicode) against the
real functions before wiring them into Atheris.

Atheris only ships prebuilt wheels for Linux + CPython 3.12-3.14 - it
doesn't build on this machine at all, since Apple Clang doesn't ship
libFuzzer. It lives in its own `fuzz` dependency group with a marker
matching that exact combination, so nothing else ever tries to install
it or falls into a doomed source build. `tox -e fuzz` is opt-in and
outside `env_list`, so no existing environment or CI job changes.

The README carries an OpenSSF Scorecard badge but not the companion Best
Practices one, so a reader has no signal about the self-certification
work behind the [bestpractices.dev
project](https://www.bestpractices.dev/projects/14689). The Scorecard
`CII-Best-Practices` check reads that project directly, which makes it
part of the same security-posture story the neighbouring badge already
tells.

The badge image reflects the live tier, so it moves from `in progress`
to `passing` on its own once the remaining criteria are answered. No
workflow or packaging change is involved.