Establish continuous fuzz testing

[jamessawle]

Scorecard finding

The initial OpenSSF Scorecard run assigned Fuzzing a score of 0 because it found no recognized fuzzing integration.

Scope

• Identify security-sensitive parsers and validation boundaries that benefit most from fuzzing.
• Add useful fuzz targets with a small seed corpus.
• Run them through a continuous integration recognized by OpenSSF Scorecard, such as OSS-Fuzz or CIFuzz.
• Define resource and failure-handling expectations so fuzzing remains maintainable.

Acceptance criteria

• Meaningful fuzz targets cover selected untrusted-input boundaries.
• Fuzzing runs continuously outside ordinary unit tests.
• Crashes produce actionable, reproducible reports.
• A subsequent Scorecard run detects the fuzzing integration.

Origin: #24