fix(fuzz): stub c6_sync_espnow_is_valid for the fuzz-harness link path

Iter 38 — CI guard fix. The Firmware QEMU Tests (ADR-061) Fuzz Testing
Layer 6 job was failing on PR #764 with:

  /usr/bin/ld: csi_collector.c:229: undefined reference to
    `c6_sync_espnow_is_valid'
  clang: error: linker command failed with exit code 1

Iter 11's csi_collector.c byte 19 bit 4 wire-fix added the OR'd call to
c6_sync_espnow_is_valid(), but the fuzz target only links csi_collector.c
against test/stubs/esp_stubs.c — not the real c6_sync_espnow.c
implementation. The fuzz harness needed a stub.

Fix: append a 1-line stub to esp_stubs.c that returns false. This
matches the c6_timesync.h inline-fallback pattern: under non-ESP-NOW
fuzz inputs the bit-4 sync-valid flag stays 0, which is the natural
fuzz semantic.

GHCI run that surfaced the bug: 26338405979 — Fuzz Testing (ADR-061
Layer 6) step. Next push will exercise the fix.

Co-Authored-By: claude-flow <ruv@ruv.net>

firmware/esp32-csi-node/test/stubs/esp_stubs.c

@@ -73,3 +73,13 @@ static mmwave_state_t s_stub_mmwave = {0};
 esp_err_t mmwave_sensor_init(int tx, int rx) { (void)tx; (void)rx; return ESP_ERR_NOT_FOUND; }
 bool mmwave_sensor_get_state(mmwave_state_t *s) { if (s) *s = s_stub_mmwave; return false; }
 const char *mmwave_type_name(mmwave_type_t t) { (void)t; return "None"; }
+
+/* ADR-110 iter 38 — fuzz-harness stub for c6_sync_espnow_is_valid.
+ * Real implementation lives in main/c6_sync_espnow.c; the fuzz target
+ * (`fuzz_serialize`) only links csi_collector.c against esp_stubs.c, so
+ * iter-11's `if (c6_sync_espnow_is_valid()) flags |= (1 << 4);` needs a
+ * symbol here or `clang -fsanitize=fuzzer` fails with an undefined-reference
+ * linker error. Returning false means the bit-4 cross-node-sync-valid flag
+ * stays 0 in fuzz inputs, which is the natural fuzz semantic. */
+#include <stdbool.h>
+bool c6_sync_espnow_is_valid(void) { return false; }