Add parser fuzz corpora for configuration and the agent protocol

[ben-ranford]

Outcome

Synthetic persona: Noor — automation client author. Job: Exercise malformed and boundary-size machine input before shipping an agent-facing minor release.

This is a repository-grounded improvement hypothesis from a synthetic workflow exercise, not validated customer demand.

Evidence

Baseline: 64b0d0d96954 / v1.0.0-rc.2.

• Repository fuzz inventory contains five targets: primitive text controls, surface Diff/Apply, terminal sanitize, string width and layout Arrange.
• config/config.go:193-216 parses external JSON layers; runtime/agent/server.go:153-200 frames external messages. Neither area currently declares a Fuzz target.
• scripts/rigor/run-fuzz-smoke.sh:12 runs one fuzz iteration; keep PR smoke deterministic and give sustained fuzzing a separate bounded lane.

Bounded scope

Add focused fuzz entrypoints/corpora for config parsing/canonicalization and protocol framing/validation. Seed from existing negative fixtures and confirmed findings; enforce byte/depth bounds to keep tests cheap.

Acceptance checks

• Seeds cover duplicate/unknown fields, trailing/null input, malformed UTF8/JSON, nested values and exact size-limit boundaries.
• Properties include no panics, bounded handling, canonical round trips for accepted input and no secret echo in errors.
• All discovered regressions become deterministic seeds; target discovery is checked.
• PR smoke and an optional bounded longer run have documented invocations; do not claim absence of vulnerabilities from a fuzz pass.

Compatibility and dependencies

Preserve the v1 root API and wire meanings. Additive tooling/docs or behavior-preserving validation; no root dependency or minimum-Go increase is implied.

Dependencies: #39

Milestone plan and shared release prerequisites: #38. Priority: P2. Required verification must preserve existing gates; completing this issue does not itself authorize a release.