Add sanitizer and fuzzing support with CI coverage

[gafferongames]

Summary

Hardens netcode's hostile-input surface with sanitizers and fuzzing, wired into CI. Both CMake options are off by default, so the existing 6-cell build matrix is unchanged.

CMake options

• NETCODE_SANITIZE — builds everything with AddressSanitizer + UndefinedBehaviorSanitizer. The vendored sodium subset is exempted from UBSan (third-party SIMD crypto uses intentional type punning / unaligned access that UBSan flags but isn't netcode's to fix) but still gets ASan.
• NETCODE_FUZZ — builds the fuzz/ harnesses. Where the compiler ships libFuzzer (LLVM clang) they are libFuzzer targets; elsewhere (AppleClang, GCC, MSVC) they build as a standalone file replayer, so the harnesses compile everywhere and a crashing input reproduces anywhere.

Fuzz harnesses (fuzz/)

Cover the code paths that parse untrusted bytes, each with a write/read round-trip invariant:

• fuzz_read_packet — netcode_read_packet, the reader every client/server runs on received datagrams; both raw-input and encrypted round-trip paths, including the connect-token request path (token encrypted with the real private key so the full decrypt+read is exercised).
• fuzz_connect_token — the public and private connect token readers, plus a private-token round-trip.
• fuzz_parse_address — netcode_parse_address plus a to_string → parse round-trip.

CI

Two new jobs on ubuntu-24.04 with clang:

• sanitizers — configure -DNETCODE_SANITIZE=ON, build all, run ctest with halt_on_error.
• fuzz (smoke) — build the fuzz targets, run each for 60s bounded, upload any crash-*/oom-*/timeout-* inputs as an artifact on failure.

Test plan

• Default build (options off) unchanged: builds + 37 tests pass locally
• NETCODE_SANITIZE=ON: builds clean, all tests pass under ASan+UBSan locally (Apple Silicon)
• NETCODE_FUZZ=ON: all three harnesses build (standalone fallback on AppleClang) and run clean over ~200 random inputs under ASan/UBSan
• CI: real coverage-guided libFuzzer run on the Linux clang leg (first run — this is where actual fuzzing happens, since no local LLVM clang)

🤖 Generated with Claude Code