CI: run panic_hunt in the Linux test job

The full-registry fuzz (AGENTS.md Rule 9) is #[ignore]d and no workflow ran it, so nothing
enforced "must stay green". The new step reruns the Test step's nextest selection with
--run-ignored only, filtered to the panic_hunt binary, so nothing rebuilds; the ci profile
terminates it if it hangs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -193,6 +193,16 @@ jobs:
           cargo nextest run --profile ci --workspace --locked --features heif "${targets[@]}"
         shell: bash
 
+      # Every command against adversarial params must return Err, never panic or hang (AGENTS.md
+      # Rule 9). It is `#[ignore]`d (slow), so Test skips it. Same packages, features and targets as
+      # Test, so nothing rebuilds: `--test panic_hunt` would drop the other crates' dev-dependency
+      # features and recompile the whole graph. The `ci` profile terminates it if it hangs.
+      - name: Panic hunt
+        if: runner.os == 'Linux'
+        run: >-
+          cargo nextest run --profile ci --workspace --locked --features heif --lib --bins --tests
+          --run-ignored only -E 'binary_id(photocraft-engine::panic_hunt)'
+
       - name: Doctests
         if: matrix.part == 'all' || matrix.part == 'unit'
         run: cargo test --workspace --locked --features heif --doc