Add hostile-network tests, parser fuzzing, and CI fuzz job

Track B (milestone 5 / §16 hardening):

- tests/hostile_network.rs: in-process UDP relay/shim between a test
  client and a real dosh-server that can drop, reorder, and duplicate
  datagrams, and rebind its upstream socket mid-session. Asserts:
  session survives loss/reorder, duplicated/replayed Input is applied at
  most once, stale packets after resume are ignored (not fatal), and a
  client source-address change preserves the session.
- tests/parser_robustness.rs: deterministic randomized tests throwing
  garbage at every reachable public parser (packet decode, from_body for
  all protocol/native structs, authorized_keys, known_hosts, host-key
  line, ssh-ed25519 blob, bootstrap, attach ticket); asserts none panic.
- fuzz/: standalone cargo-fuzz crate (own [workspace], non-default
  member) with libfuzzer-sys harnesses for packet decode, from_body,
  authorized_keys, known_hosts, handshake structs+verifiers, and attach
  tickets. README documents the run command.
- .github/workflows/ci.yml: add fuzz-smoke job (nightly + cargo-fuzz,
  short -max_total_time per target, tolerant if tooling unavailable);
  existing fmt/test/build/bench steps unchanged.

cargo fmt --check and cargo test are green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -19,6 +19,38 @@ jobs:
       - name: Docker SSH benchmark gate
         run: sh scripts/ci-docker-ssh-bench.sh
 
+  fuzz-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install nightly toolchain
+        id: nightly
+        continue-on-error: true
+        uses: dtolnay/rust-toolchain@nightly
+      - name: Install cargo-fuzz
+        id: install
+        if: steps.nightly.outcome == 'success'
+        continue-on-error: true
+        run: cargo install cargo-fuzz --locked
+      - name: Run fuzz targets briefly
+        if: steps.nightly.outcome == 'success' && steps.install.outcome == 'success'
+        run: |
+          set -e
+          for target in \
+            packet_decode \
+            from_body \
+            authorized_keys \
+            known_hosts \
+            handshake_structs \
+            attach_ticket; do
+            echo "== fuzzing $target =="
+            cargo +nightly fuzz run --fuzz-dir fuzz "$target" -- \
+              -max_total_time=20 -rss_limit_mb=4096
+          done
+      - name: Note when fuzzing was skipped
+        if: steps.nightly.outcome != 'success' || steps.install.outcome != 'success'
+        run: echo "cargo-fuzz / nightly toolchain unavailable; skipped fuzz smoke run."
+
   remote-bench:
     runs-on: ubuntu-latest
     env: