test: fuzz bounded protocol parsers

scripts/test-fuzz

@@ -0,0 +1,39 @@
+#!/bin/sh
+# Run one bounded Go fuzz target in the pinned RVBox toolchain container.
+set -eu
+
+repo_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+
+usage() {
+    cat <<'EOF'
+usage: scripts/test-fuzz --package ./PACKAGE --name FUZZ_TEST [--time DURATION]
+
+Runs exactly one Fuzz* target with ordinary unit tests disabled. The default
+duration is 30s. A crash leaves Go's minimal reproducer in the package fuzz
+corpus, where it becomes a normal deterministic seed on the next test run.
+EOF
+}
+
+fail() { printf '%s\n' "test-fuzz: $*" >&2; exit 2; }
+
+package=
+name=
+duration=30s
+while [ "$#" -gt 0 ]; do
+    case $1 in
+        --package) [ "$#" -ge 2 ] || fail "--package needs a value"; package=$2; shift 2 ;;
+        --name) [ "$#" -ge 2 ] || fail "--name needs a value"; name=$2; shift 2 ;;
+        --time) [ "$#" -ge 2 ] || fail "--time needs a value"; duration=$2; shift 2 ;;
+        --help|-h) usage; exit 0 ;;
+        *) fail "unknown argument $1" ;;
+    esac
+done
+
+case $package in ./*) ;; *) fail "--package must be a repository-relative Go package" ;; esac
+case $name in Fuzz*) ;; *) fail "--name must be a Fuzz* test function" ;; esac
+case $name in *[!A-Za-z0-9_]* ) fail "--name contains unsupported characters" ;; esac
+case $duration in *[!0-9a-zA-Z.]*) fail "--time contains unsupported characters" ;; esac
+
+cd "$repo_root"
+exec docker compose -f deploy/compose.yaml run --rm toolchain \
+    go test "$package" -run '^$' -fuzz "$name" -fuzztime "$duration"