F22-06: Fuzz testing for FFI boundary

[aram-devdocs]

Parent: #137

Fuzz inputs to FFI functions using cargo-fuzz or libFuzzer to discover crash-inducing inputs.

Acceptance Criteria

• Fuzz targets defined for high-risk FFI functions (pointer-heavy, string inputs)
• Fuzzer runs for a defined corpus size in CI (or on-demand)
• Any crashes found are converted into regression tests
• Documented how to run fuzzing locally
• Fuzzing corpus stored and can be extended

[aram-devdocs]

Closing as superseded by the ENG2 v2 rebuild program.

• Replacement: ENG2-P3-09 ((ENG2-P3-09?)) — FFI fuzz harness
• Runbook: docs/src/runbook/phase-index.md · Master: ENG2: GoudEngine v2 Rebuild — Master Tracking #810

Nothing was dropped — the v2 roadmap was designed from a full-engine code audit that covers this issue's area. If you believe scope was lost, comment on #810.