test(fuzz): fuzz parsers and protocol decoders on pull requests and schedules

[pierrick-fonquerne]

Goal

Continuously exercise every untrusted parsing boundary with coverage-guided fuzzing and preserve discovered crashes as deterministic regressions.

Initial targets

• flagd ruleset and JsonLogic parsing/round-trip
• incremental SSE decoding
• ETag and HTTP precondition parsing
• SDK key and bearer credential parsing
• client snapshot parsing
• OFREP request contexts and bulk payloads

Acceptance criteria

• A standalone fuzz/ workspace uses a pinned cargo-fuzz/libFuzzer toolchain.
• Pull requests run a short bounded corpus without secrets or write permissions.
• Scheduled runs give each target a documented time and input-size budget.
• Parser targets assert semantic invariants such as successful parse → canonical serialize → successful equivalent reparse.
• Input-size caps prevent the fuzzer itself from turning into an unbounded CI workload.
• Crashes are minimized and converted into committed corpus entries or deterministic regression tests.
• Corpus and crash artifacts never contain credentials, production snapshots, or user evaluation contexts.
• CI logs identify the target, seed and reproduction command.
• Fuzzing failures block merge once the initial corpus is stable.