Add comprehensive fuzz testing infrastructure with automated CI/CD integration (#25)

Implements fuzz testing to ensure the testscript-rs parser is resilient
to malformed, malicious, or unexpected input. This addresses security
and stability concerns by systematically testing edge cases that could
cause crashes, panics, or vulnerabilities.

## What's Added

**Fuzz Testing Infrastructure:**
- Four specialized fuzz targets using `cargo-fuzz` and libFuzzer
- Structured input generation with the `arbitrary` crate
- Comprehensive seed corpus with 26+ test cases for better coverage
- Complete documentation for developers and CI integration

**GitHub Actions Integration:**
- Automated daily fuzzing workflow that runs at 2 AM UTC
- Manual trigger capability via `workflow_dispatch` with configurable
parameters
- Automatic crash detection and artifact upload
- Corpus preservation for improved coverage over time

**Security Testing Coverage:**
- **Path traversal attempts**: Tests filenames like `../../etc/passwd`
- **Command injection patterns**: Malicious command sequences and
arguments
- **Memory safety**: Ensures no crashes, infinite loops, or excessive
memory usage
- **Input validation**: Verifies proper error handling for malformed
input
- **UTF-8 handling**: Graceful degradation for invalid byte sequences

## Fuzz Targets

1. **`parser`** - Tests the main `parser::parse()` function with
completely random bytes
2. **`tokens`** - Focuses on command parsing with various quoting,
conditions, and negation
3. **`env_substitution`** - Tests environment variable substitution with
edge cases and special characters
4. **`structured`** - Uses `arbitrary` to generate well-formed but
boundary-case txtar content

## Usage

**Local Testing:**
```bash
# Install fuzzing tools
cargo install cargo-fuzz
rustup default nightly

# Run parser fuzzing
cargo fuzz run parser

# Quick test all targets
for target in parser tokens env_substitution structured; do
    timeout 30 cargo fuzz run "$target"
done
```

**GitHub Actions:**
1. Navigate to Actions → "Fuzz Testing" workflow
2. Click "Run workflow" to trigger manual execution
3. Optionally configure duration and run count parameters

## Results

All fuzz targets achieve high code coverage (300+ coverage points each)
and successfully handle malformed input without panics. The parser
maintains deterministic behavior and properly rejects security-sensitive
patterns like path traversal attempts.

**Files Added:**
- `fuzz/` - Complete fuzzing infrastructure
- `FUZZ.md` - Quick start documentation
- `fuzz/README.md` - Comprehensive fuzzing guide
- `.github/workflows/fuzz.yml` - Automated CI/CD workflow
- Four fuzz targets with seed corpus files

This implementation provides ongoing security assurance as the parser
evolves with both local development tools and automated continuous
testing through GitHub Actions.

<!-- START COPILOT CODING AGENT SUFFIX -->



<details>

<summary>Original prompt</summary>

> 
> ----
> 
> *This section details on the original issue you should resolve*
> 
> <issue_title>Add fuzz testing for parser resilience</issue_title>
> <issue_description>## Feature Request: Fuzz Testing
> 
> Since testscript-rs parses arbitrary user input in `.txtar` format, we
should add fuzz testing to ensure the parser is resilient to malformed,
malicious, or unexpected input.
> 
> ## Fuzz Testing Targets
> 
> ### **Primary Target: Parser**
> - **`parser::parse()`** - Main entry point for parsing .txtar content
> - Test with malformed file headers, invalid command syntax, edge cases
> - Ensure parser never panics, always returns proper errors
> 
> ### **Secondary Targets:**
> - **Command token parsing** - `parse_command_tokens()`
> - **Environment variable substitution** - `substitute_env_vars()`
> - **File path handling** - Directory traversal attempts, special
characters
> 
> ## Implementation
> 
> Use `cargo-fuzz` with libFuzzer:
> 
> ```toml
> # Cargo.toml
> [dev-dependencies]
> arbitrary = { version = "1.0", features = ["derive"] }
> 
> # fuzz/Cargo.toml
> [dependencies.testscript-rs]
> path = ".."
> 
> [dependencies]
> libfuzzer-sys = "0.4"
> arbitrary = { version = "1.0", features = ["derive"] }
> ```
> 
> ## Fuzz Test Cases
> 
> 1. **Random .txtar content** - Completely random bytes
> 2. **Structured fuzzing** - Valid-looking but malformed txtar
> 3. **Command injection attempts** - Malicious command patterns
> 4. **Path traversal attempts** - `../../../etc/passwd` in filenames
> 5. **Large inputs** - Very long lines, many files, deep nesting
> 6. **Unicode edge cases** - Invalid UTF-8, special characters
> 
> ## Success Criteria
> 
> - Parser never panics on any input
> - All errors are properly structured (using our Error types)
> - No infinite loops or excessive memory usage
> - Security: No path traversal or command injection vulnerabilities
> 
> ## Commands
> 
> ```bash
> cargo install cargo-fuzz
> cargo fuzz run parser
> cargo fuzz run tokens
> ```</issue_description>
> 
> ## Comments on the Issue (you are @copilot in this section)
> 
> <comments>
> </comments>
> 


</details>
Fixes imjasonh/testscript-rs#11

<!-- START COPILOT CODING AGENT TIPS -->
---

💬 Share your feedback on Copilot coding agent for the chance to win a
$200 gift card! Click
[here](https://survey3.medallia.com/?EAHeSx-AP01bZqG0Ld9QLQ) to start
the survey.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: imjasonh <210737+imjasonh@users.noreply.github.com>

.github/workflows/fuzz.yml

@@ -0,0 +1,127 @@
+---
+name: Fuzz Testing
+
+"on":
+  # Run daily at 2 AM UTC
+  schedule:
+    - cron: '0 2 * * *'
+
+  # Allow manual triggering
+  workflow_dispatch:
+    inputs:
+      fuzz_duration:
+        description: 'Duration to run each fuzz target (seconds)'
+        required: false
+        default: '300'
+        type: string
+      max_runs:
+        description: 'Maximum number of runs per target'
+        required: false
+        default: '100000'
+        type: string
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  fuzz:
+    name: Fuzz Testing
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Install Rust nightly
+      uses: dtolnay/rust-toolchain@nightly
+
+    - name: Install cargo-fuzz
+      run: cargo install cargo-fuzz
+
+    - name: Cache cargo registry
+      uses: actions/cache@v3
+      with:
+        path: ~/.cargo/registry
+        key: >-
+          ${{ runner.os }}-cargo-registry-fuzz-${{ hashFiles('**/Cargo.lock') }}
+
+    - name: Cache cargo index
+      uses: actions/cache@v3
+      with:
+        path: ~/.cargo/git
+        key: >-
+          ${{ runner.os }}-cargo-index-fuzz-${{ hashFiles('**/Cargo.lock') }}
+
+    - name: Cache fuzz targets
+      uses: actions/cache@v3
+      with:
+        path: fuzz/target
+        key: >-
+          ${{ runner.os }}-fuzz-target-${{ hashFiles('**/Cargo.lock') }}
+
+    - name: Build fuzz targets
+      run: |
+        cd fuzz
+        cargo fuzz build parser
+        cargo fuzz build tokens
+        cargo fuzz build env_substitution
+        cargo fuzz build structured
+
+    - name: Run parser fuzz target
+      run: >
+        timeout ${{ inputs.fuzz_duration || '300' }} cargo fuzz run parser --
+        -timeout=10
+        -runs=${{ inputs.max_runs || '100000' }}
+        -max_len=8192
+        -print_final_stats=1 || true
+
+    - name: Run tokens fuzz target
+      run: >
+        timeout ${{ inputs.fuzz_duration || '300' }} cargo fuzz run tokens --
+        -timeout=10
+        -runs=${{ inputs.max_runs || '100000' }}
+        -max_len=1024
+        -print_final_stats=1 || true
+
+    - name: Run env_substitution fuzz target
+      run: >
+        timeout ${{ inputs.fuzz_duration || '300' }} cargo fuzz run
+        env_substitution --
+        -timeout=10
+        -runs=${{ inputs.max_runs || '100000' }}
+        -max_len=1024
+        -print_final_stats=1 || true
+
+    - name: Run structured fuzz target
+      run: >
+        timeout ${{ inputs.fuzz_duration || '300' }} cargo fuzz run structured --
+        -timeout=10
+        -runs=${{ inputs.max_runs || '100000' }}
+        -max_len=4096
+        -print_final_stats=1 || true
+
+    - name: Check for crashes
+      run: |
+        if find fuzz/artifacts -name "crash-*" -type f | grep -q .; then
+          echo "🚨 Crashes found!"
+          find fuzz/artifacts -name "crash-*" -type f -exec echo "Crash: {}" \;
+          find fuzz/artifacts -name "crash-*" -type f -exec xxd -l 256 {} \;
+          exit 1
+        else
+          echo "✅ No crashes found"
+        fi
+
+    - name: Upload crash artifacts
+      if: failure()
+      uses: actions/upload-artifact@v3
+      with:
+        name: fuzz-crash-artifacts
+        path: fuzz/artifacts/
+        retention-days: 30
+
+    - name: Upload fuzz corpus
+      if: always()
+      uses: actions/upload-artifact@v3
+      with:
+        name: fuzz-corpus
+        path: fuzz/corpus/
+        retention-days: 7