Add cargo-fuzz targets for the untrusted-input parsers and the hardening report

envelope_json, manifest_decode, item_replay, secret_key_parse, totp_parse, url_match,
with seeds. fuzz/README.md records the runs (and the server/desktop targets), the two
bugs fixed in the previous commits, dependency-policy results, CI changes and the
deploy check.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

fuzz/fuzz_targets/envelope_json.rs

@@ -0,0 +1,12 @@
+//! kv-proto Envelope JSON decode: anything accepted must re-encode and decode to the same value.
+#![no_main]
+use kv_proto::Envelope;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    if let Ok(e) = serde_json::from_slice::<Envelope>(data) {
+        let again = serde_json::to_vec(&e).expect("re-encode");
+        let back: Envelope = serde_json::from_slice(&again).expect("decode own encoding");
+        assert_eq!(back, e);
+    }
+});