Fuzz the native-messaging framing and the broker's pairing protocol

src-tauri/fuzz: nmh_session drives a whole kestrove-nmh connection through
Broker::serve (framing, outer JSON, pair_init/pair_confirm/open/msg); frame_read
checks read_frame. 8 min each (2.5 M / 2.7 M execs): no findings.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src-tauri/fuzz/fuzz_targets/frame_read.rs

@@ -0,0 +1,19 @@
+//! Native-messaging framing (src/framing.rs): never panics or over-allocates, and every frame read
+//! back is one that write_frame would have produced.
+#![no_main]
+use kestrove_desktop::framing::{read_frame, write_frame, MAX_FRAME};
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let mut r = data;
+    while let Ok(Some(frame)) = read_frame(&mut r) {
+        assert!(frame.len() <= MAX_FRAME);
+        let mut out = Vec::new();
+        write_frame(&mut out, &frame).expect("re-frame");
+        let mut again = out.as_slice();
+        assert_eq!(
+            read_frame(&mut again).unwrap().as_deref(),
+            Some(frame.as_slice())
+        );
+    }
+});