Coverage-guided fuzz testing

We have some randomised testing with proptest, but we could probably exercise edge cases more reliably with branch coverage information. The main obstable is that allocation classes are immortal and stateful (they remember freed allocations), so we probably want to fork for each call... and rust fuzzers seem to really want to run in persistent mode.