✅[Test] Sprint 9 Property Testing and Fuzz Harness - #16

Summary

• adds fast-check 4.9.0 as the single dev-only property dependency with fixed seed/path replay and shrinking
• adds arbitrary-byte, subview, metadata-limit, JPEG, WebP, PNG, and shared TIFF parser properties
• adds valid-fixture cleaner properties for determinism, idempotency, source immutability, output reinspection, removal-only sizing, ICC/unknown preservation, and format-specific retained bytes
• adds fail-closed verification properties for incomplete and metadata-truncated observations
• adds a finite public-API fuzz harness with explicit target, seed, path, run, and input-size controls
• extends the existing CI validate job with a deterministic fuzz smoke run and documents replay/regression promotion

Issues

Closes #11
Closes #12
Closes #13
Closes #14
Closes #15

Generated Testing

• framework: fast-check 4.9.0, dev-only; built-in shrinking and seed + path replay
• property definitions: 13
• property iterations: 704 total (7 parser/inspection × 64, 5 cleaner/verification × 48, 1 infrastructure × 16)
• property input bound: 1,024 bytes
• fuzz smoke: 250 total iterations, seed 20260825, 512-byte maximum
• local fuzz default: 5,000 finite iterations, seed 0x5ec00009, 4,096-byte maximum
• failures print target, configured target, seed, run, path, shrink count, bounded hex input, and replay command

Defects

No new correctness or security defects were discovered. One initially shrunk TIFF counterexample identified an incorrect property model (an Exif tag placed in IFD0), which was corrected without production changes.

Validation

• format: passed (npm run format:check)
• lint: passed (npm run lint)
• typecheck: passed (npm run typecheck)
• tests: 26 files, 233 Vitest cases passed in 1.45s (npm test)
• properties: 3 files, 13 definitions, 704 iterations passed in 653ms
• fuzz smoke: 250 iterations passed in 3.19s (npm run fuzz:smoke)
• build: passed (npm run build)
• bundle leak check: no fast-check or pure-rand imports in src/dist
• package dry run: 7 files, 51,338 bytes packed, 270,749 bytes unpacked; tests/scripts excluded
• runtime dependencies: 0; development dependencies: 9
• audit: 0 vulnerabilities (npm audit)
• CI: passed in 24s

Scope

• No new format support or production API exposure
• No production source changes
• No unbounded or elapsed-time fuzzing
• No property/fuzz code in the production package