Legacy TraceCmp truncates 64-bit Hamming distance to 32 bits #2319

Legacy TraceCmp accepts uint64_t arguments but computes their XOR's popcount with __builtin_popcount, which takes an unsigned int.
On hosts where unsigned int is 32 bits, this discards the upper 32 bits of the XOR.
Arguments differing only in those bits can therefore receive the highest possible closeness score.

In coverage.cc:

argsize_bit - __builtin_popcount(arg1 ^ arg2)

For arg1 = uint64_t{0x000000FF00000000} and arg2 = 0:

arg1 bytes (most-significant first): 00 00 00 FF 00 00 00 00
Only four bits differ, all in the discarded upper 32 bits.

Expected: 64 - 4 = 60
Actual:   64 - 0 = 64   // incorrectly reports maximal closeness

UpdateCmpMap uses this score for comparison feedback. Upper-half-only differences cannot improve it.

This affects FuzzTest's legacy coverage path, the default when neither Centipede integration nor libFuzzer compatibility mode is enabled.
These callbacks are compiled out in those alternative modes.

Centipede already uses the full-width builtin in ABToCmpHamming:

inline uintptr_t ABToCmpHamming(uintptr_t a, uintptr_t b) {
  return 64 - __builtin_popcountll(a ^ b);
}