test(core): add parser and wire-format fuzz targets #1087

Parent

Part of #1084.

Scope

Implement the second structured fuzzing slice for Astrid: parser and wire-format fuzz targets for untrusted TOML and JSON inputs. This corresponds to PR 2 from the rollout plan in #1084.

Included

• Add a manifest_toml fuzz target for Capsule.toml deserialization and normalized manifest invariants.
• Add a config_toml fuzz target for astrid-config TOML deserialization plus post-parse validation.
• Add an admin_json fuzz target for kernel/admin JSON request and response wire formats.
• Add an opt-in gateway_request_json fuzz target for public HTTP gateway request DTOs.
• Keep heavier parser targets feature-gated so normal workspace builds and the cheap default fuzz target set remain controlled.
• Update fuzz/README.md with the new parser/wire-format targets and feature gates.

Out Of Scope

• Archive and install fuzzing.
• Shared admin authorization state-machine fuzzing.
• Full HTTP router boundary fuzzing with status-code assertions.
• CLI parser/request-builder fuzzing.
• Wasm/WIT/load validation fuzzing.
• Nightly fuzz scheduling, coverage, sanitizer lanes, and corpus minimization workflow.

Those remain tracked by #1084 and should land as separate follow-up PRs/issues.

Acceptance Criteria

• Parser fuzz targets exist for capsule manifests, config TOML, admin/kernel JSON, and representative gateway request bodies.
• Successful parses assert local invariants beyond "does not panic".
• Heavy parser targets are opt-in via Cargo features.
• The standalone fuzz package still compiles with the new target feature gates.
• The PR links back to test(core): design structured fuzzing coverage for CLI, HTTP, and kernel boundaries #1084 without closing the umbrella issue.