chore: audit cleanup, CI, cargo-deny, encode fuzz target (0.3.4)

Simplify encoder exit branch (−41 B code size), add GitHub Actions CI
with MSRV matrix, cargo-deny with permissive-only license policy,
encode-only fuzz target, and feature coverage across test gates.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -10,9 +10,9 @@
 
 1. **Correct** — 100% COBS spec-compliant (Cheshire & Baker 1999). No shortcuts, no deviations.
 2. **Interoperable** — proven byte-for-byte compatibility with `corncobs`, `cobs` crates and Python `cobs` packages.
-3. **Insanely tested** — canonical vectors, property-based tests (proptest), fuzz targets (cargo-fuzz), cross-crate interop, randomized payloads. If you think testing is done, you're 10% done.
-4. **Fast** — benchmark against every competing implementation. Must be at least as fast, ideally fastest. Benchmarks are CI-enforced.
-5. **Tiny** — `no_std`, zero-alloc, zero runtime dependencies. ~120 lines of implementation. Runs on 8-bit MCUs and servers alike.
+3. **Insanely tested** — canonical vectors, property-based tests (proptest), fuzz targets (cargo-fuzz), cross-crate interop, miri, mutation testing, randomized payloads. If you think testing is done, you're 10% done.
+4. **Fast** — benchmark against every competing implementation. Must be at least as fast, ideally fastest. Benchmarks run via `just bench`.
+5. **Tiny** — `no_std`, zero-alloc, zero runtime dependencies. ~140 lines of implementation. Runs on 8-bit MCUs and servers alike.
 6. **Trustworthy** — small enough to audit by hand. No unsafe. No panics in release. Fuzz-hardened.
 
 ## Architecture
@@ -22,7 +22,7 @@ Single-file library: `src/lib.rs`
 ### Public API (3 functions)
 
 ```rust
-pub fn encode(src: &[u8], dest: &mut [u8]) -> Option<usize>
+pub const fn encode(src: &[u8], dest: &mut [u8]) -> Option<usize>
 pub fn decode(src: &[u8], dest: &mut [u8]) -> Option<usize>
 pub const fn max_encoded_len(src_len: usize) -> usize
 ```
@@ -32,26 +32,29 @@ pub const fn max_encoded_len(src_len: usize) -> usize
 ## Development
 
 ```sh
-# Run all tests
-cargo test
+# Run all quality gates (tests, clippy, fmt, doc, fuzz, miri, mutants)
+just test
+
+# Unit + property + interop tests only
+just test-unit
+
+# Benchmarks (iai-callgrind, requires valgrind)
+just bench
 
 # Fuzz (requires nightly + cargo-fuzz)
-cd fuzz
-cargo +nightly fuzz run fuzz_decode -- -max_total_time=60
-cargo +nightly fuzz run fuzz_roundtrip -- -max_total_time=60
+just test-fuzz
 ```
 
 ## Dev Dependencies (test-only)
 
+- `cobs` — cross-validation against the `cobs` 0.5 crate
 - `corncobs` — cross-validation against another COBS implementation
+- `iai-callgrind` — deterministic instruction-count benchmarks
+- `mutants` — mutation testing annotations
 - `proptest` — property-based testing
 - `rand` — randomized test payloads
 
 ## Roadmap
 
-- More interop targets: `cobs` crate, Python `cobs` package
-- Benchmarks (criterion) vs corncobs, cobs, and others
 - quickcheck in addition to proptest
 - Even more fuzz targets and edge-case generators
-- MSRV policy and CI
-- `#[deny(unsafe_code)]` badge