ci: pin cpp-FuSa to v0.18.0 instead of floating on default branch

[SoundMatt]

Summary

Fixes a floating-dependency policy violation, not just a version bump.

Both workflows that build the cpfusa safety-tooling binary from source cloned it with:

git clone --depth=1 https://github.com/SoundMatt/cpp-FuSa /tmp/cpfusa

No --branch/tag — so every CI run built whatever commit happened to be on cpp-FuSa's default branch at that moment. Per the project's standing decision (confirmed 2026-07-28: "pin every repo, every language — floating is worse than a stale pin"), this means CI pass/fail could change with no cpp-RCP-side change at all, which isn't reproducible and isn't something a reviewer can audit from the diff.

This pins both occurrences to v0.18.0 (cpp-FuSa's latest release):

• ci.yml's cpfusa-build job (shared by all cpfusa-* jobs via upload/download-artifact)
• release.yml's regenerate-safety-artifacts job (tag-triggered; builds its own cpfusa independently rather than reusing ci.yml's artifact)

All other cpfusa-* jobs in ci.yml consume the shared build artifact, so there was no third occurrence to fix.

Verification

Built cpfusa v0.18.0 from source locally the same way CI now will, and ran every cpfusa subcommand either workflow invokes, against cpp-RCP's own tree:

• ci.yml set: check, lint, cyber, trace (incl. --req-coverage 100), qualify, vuln, verify, analyze, impact, metrics, report — all exit 0, 0 errors.
• release.yml set: fmea --cyber, safety-case, tara, release (SBOM/provenance), sas, sci, audit-pack, badge, report — all exit 0. iso26262/iec61508/do178 gap-report commands exit 1 as already documented in release.yml's comments (non-gating || true, pre-existing stub-bridge gaps against ASIL-B/SIL-2/DAL-B thresholds — not new).
• hara (display) — 0 issues.

No new or different ERROR-level findings vs. whatever was floating before this pin — a clean, no-op-for-findings version lock.

One local-only false alarm caught and ruled out along the way: an initial cpfusa lint run showed 5 errors, all inside build/_deps/catch2-src — a FetchContent-vendored dependency that only existed because a full cmake build had been run in that checkout first. CI's actual cpfusa-lint job never runs cmake, so it never sees that path; re-running against a clean checkout with no build/ directory confirmed 0 errors.

Also ran this repo's full local build/test suite against the pin:

• cmake+ninja build: 213/213 targets (twice, in separate checkouts)
• ctest: 52/52 passed (twice)
• clang-tidy scoped to tests/*.cpp: clean aside from the same pre-existing bugprone-infinite-loop false positive in test_request.cpp already documented in commit 181e6e2 (ci: bump pinned RELAY conformance validator to v2.0.4 #96) as a newer-local-clang-tidy-vs-CI's-pinned-clang-14 artifact — this change touches no C++ source, so it cannot be the cause.

No behavior change and no conformance gap found, so no version bump (cpp-rcp stays at 2.19.0): CI-workflow-only change, consistent with this repo's convention of reserving version bumps for commits that touch library code or behavior.

Test plan

• cpfusa v0.18.0 built from source and confirmed via cpfusa version
• Full ci.yml cpfusa-* subcommand set run against cpp-RCP tree — 0 errors
• Full release.yml cpfusa subcommand set run against cpp-RCP tree — 0 errors (gap reports exit 1 as documented/expected)
• cmake+ninja build: 213/213 targets
• ctest: 52/52 passed
• clang-tidy: clean aside from documented pre-existing false positive
• CI green on this PR (pending)