test: cargo-fuzz targets on parser and framing

Four libFuzzer targets:
- parse_command: Command::from_bytes never panics; bounded payload.
- parse_radio_config: RadioConfig::from_bytes never panics.
- cobs_decoder_feed: CobsDecoder::feed is panic-free across arbitrary
  byte streams split into arbitrary chunks.
- cobs_roundtrip: structure-aware (via arbitrary crate) Response →
  cobs_encode_response → ucobs::decode yields identical raw bytes.

All four smoke-tested at 50k runs each with no findings. Intended CI
cadence is a weekly cron with a larger time budget; per-PR would be
expensive. Requires nightly + cargo-fuzz.

fuzz/Cargo.toml

@@ -0,0 +1,51 @@
+[package]
+name = "donglora-protocol-fuzz"
+version = "0.0.0"
+edition = "2024"
+publish = false
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+arbitrary = { version = "1", features = ["derive"] }
+heapless = "0.9"
+ucobs = "0.3"
+
+[dependencies.donglora-protocol]
+path = ".."
+default-features = false
+features = ["std"]
+
+# Prevent this from being picked up by a workspace scan of the parent repo.
+[workspace]
+members = ["."]
+
+[[bin]]
+name = "parse_command"
+path = "fuzz_targets/parse_command.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "parse_radio_config"
+path = "fuzz_targets/parse_radio_config.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "cobs_decoder_feed"
+path = "fuzz_targets/cobs_decoder_feed.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "cobs_roundtrip"
+path = "fuzz_targets/cobs_roundtrip.rs"
+test = false
+doc = false
+bench = false