Fuzz the native-messaging framing and the broker's pairing protocol

src-tauri/fuzz: nmh_session drives a whole kestrove-nmh connection through
Broker::serve (framing, outer JSON, pair_init/pair_confirm/open/msg); frame_read
checks read_frame. 8 min each (2.5 M / 2.7 M execs): no findings.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src-tauri/fuzz/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "kestrove-desktop-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+serde_json = "1"
+kestrove-desktop = { path = ".." }
+kv-ffi = { path = "../../../kestrove-core/crates/kv-ffi" }
+
+[workspace]
+members = ["."]
+
+[profile.release]
+debug = 1
+
+[[bin]]
+name = "nmh_session"
+path = "fuzz_targets/nmh_session.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "frame_read"
+path = "fuzz_targets/frame_read.rs"
+test = false
+doc = false
+bench = false