fuzz: add envsubst_fuzz target

[chaliy]

Summary

Add a fuzz target for the envsubst builtin (builtins/envsubst.rs). It parses $VAR and ${VAR} patterns in arbitrary text.

Scope

• Fuzz arbitrary text with variable references
• Test edge cases with special characters in variable names, nested references, unclosed braces

Priority

Low — simpler substitution logic, but edge cases with malformed references are worth testing.