selfdrive: add fuzzy TX safety coverage for control-state transitions

[liangtovi-debug]

Summary

• add test_panda_safety_tx_fuzzy in selfdrive/car/tests/test_models.py
• fuzz control-state transitions (controls_allowed, cruise engaged, cancel/resume, lat/long active)
• assert every emitted tx CAN frame passes panda safety_tx_hook
• keep runtime bounded (max(50, MAX_EXAMPLES // 3)) and deterministic via Hypothesis replay

Why

Issue #32425 asks for generic/extendable tx fuzzing that can catch mismatches between openpilot tx output and panda tx safety logic.

Test status

• local run attempted: python3 -m pytest -q selfdrive/car/tests/test_models.py -k tx_fuzzy -n0
• blocked in this environment (No module named pytest)
• expecting CI to validate on project runners

Closes #32425

[github-actions]

Process replay diff report

Replays driving segments through this PR and compares the behavior to master.
Please review any changes carefully to ensure they are expected.

✅ 0 changed, 66 passed, 0 errors

[liangtovi-debug]

Quick follow-up now that CI has completed: all required checks are green, and the process replay diff report shows 0 changed / 66 passed / 0 errors. Happy to adjust the approach if there is a preferred direction for the TX fuzz coverage.