fix: pin cpp-FuSa checkout to v0.18.0 in CI workflows

[SoundMatt]

Summary

• Both fusa-asil-b and sarif jobs in .github/workflows/ci.yml pinned SoundMatt/cpp-FuSa at ref: v0.15.0 (fix: pin cpp-FuSa checkout to v0.15.0 in CI workflows #16), three releases behind the current v0.18.0. Bumped both checkouts.

Version-jump verification (done for real, not skipped)

Built cpp-FuSa v0.18.0 locally the same way CI does (cmake -B build -S . -DCMAKE_BUILD_TYPE=Release -G Ninja && cmake --build build --parallel) and ran the full fusa-asil-b gating sequence — init, check, lint, trace, cyber, qualify, hara init, iso26262, iec61508, boundary, tara, fmea, safety-case, sas, sci, badge, vuln, metrics record, report — plus the sarif job's check --format sarif, against cpp-LIN's own tree.

No new ERROR-level findings. check/lint/cyber/qualify all pass clean (0 errors), matching v0.15.0's clean-pass status on the same tree; qualify's 8/8 case suite still passes.

One notable behavior difference, investigated and confirmed benign: cyber's scanned-file count dropped from 28 (v0.15.0) to 16 (v0.18.0), findings 43 → 33. Traced to upstream commit 8564bf0 (landed between v0.15.0 and v0.18.0), which fixed every source-walking command (check, trace, fmea, coupling, boundary, cyber, vuln) to honour .fusa.json's sourceDirs (cpp-LIN declares ["src", "include"]) per x-FuSa spec §1.2.1's MUST. v0.15.0 was over-scanning cli/ and tests/, outside this project's declared source scope; v0.18.0 correctly excludes them. This is an upstream bug fix that narrows scope to match cpp-LIN's own declared config — not a suppression of real findings.

iso26262/iec61508 gap-report commands still exit 1 (gaps > 0, expected — this project doesn't carry full formal ISO 26262 process documentation), but both calls in ci.yml are already wrapped in || true, unchanged from v0.15.0's behavior.

Full local suite (re-run before pushing)

• cmake/ninja Release build + ctest: 171/171 passed
• ASan+UBSan (Debug, -fsanitize=address,undefined): 171/171 passed
• ThreadSanitizer: not exercised locally — this sandbox's arm64 toolchain (c++ from an Alire GNAT install) lacks a linkable libtsan runtime for arm64 (___tsan_init undefined at link time). CI runs tsan natively on ubuntu-22.04/gcc-12, where TSan is supported and unaffected by this change.

Version bump

None. No library code, headers, or test vectors changed, and the tool-version jump surfaced no new findings — pure CI-pin fix, same category as #16 and #50 (neither of which bumped the version or touched CHANGELOG.md).

Test plan

• cpp-FuSa v0.18.0 built locally the same way CI does.
• Full fusa-asil-b gating sequence run against cpp-LIN's tree — 0 errors, qualify 8/8.
• sarif job's check --format sarif run against cpp-LIN's tree — 0 errors.
• Full ctest suite (Release) — 171/171 green.
• ASan+UBSan ctest suite — 171/171 green.
• CI (this PR) — pending.