Add cargo-fuzz targets for the untrusted-input parsers and the hardening report

envelope_json, manifest_decode, item_replay, secret_key_parse, totp_parse, url_match,
with seeds. fuzz/README.md records the runs (and the server/desktop targets), the two
bugs fixed in the previous commits, dependency-policy results, CI changes and the
deploy check.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

fuzz/Cargo.toml

@@ -0,0 +1,66 @@
+[package]
+name = "kestrove-core-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+serde_json = "1"
+uuid = "1"
+kv-proto = { path = "../crates/kv-proto" }
+kv-crypto = { path = "../crates/kv-crypto" }
+kv-model = { path = "../crates/kv-model" }
+kv-sync = { path = "../crates/kv-sync" }
+
+# Not part of the core workspace (crates/*); built only by `cargo +nightly fuzz`.
+[workspace]
+members = ["."]
+
+[profile.release]
+debug = 1
+
+[[bin]]
+name = "envelope_json"
+path = "fuzz_targets/envelope_json.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "manifest_decode"
+path = "fuzz_targets/manifest_decode.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "item_replay"
+path = "fuzz_targets/item_replay.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "secret_key_parse"
+path = "fuzz_targets/secret_key_parse.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "totp_parse"
+path = "fuzz_targets/totp_parse.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "url_match"
+path = "fuzz_targets/url_match.rs"
+test = false
+doc = false
+bench = false