Ideas for fuzzing stateful tests

[Zac-HD]

Stateful Greybox Fuzzing (https://mboehme.github.io/paper/USENIX22.pdf) has several nice tricks - and starting with explicitly-stateful tests lets us avoid the state-machine inference step. Some specific ideas:

• each rule method could trigger an event() or perhaps target(-n_steps) (to prioritize reaching each quickly)
• treat event-virtual-branches as a separate category rather than mixing with code branches - we want to be even across those and coverage as separate dimensions because we'll never care about not-super-rare events otherwise.
• [fancier options from the paper] are plausibly nice but let's get baselines first.