test(ci): add a scheduled fuzz smoke job

[Ayinkx]

Closes #94

What

Adds a scheduled, bounded fuzz smoke job and the fuzz targets it exercises.

• .github/workflows/fuzz.yml: runs weekly (Mondays 03:00 UTC) and on workflow_dispatch. It discovers every target under fuzz/fuzz_targets/, runs each for a bounded time (60s by default) on nightly via cargo-fuzz, fails on crash artifacts, and uploads fuzz/artifacts when a run fails.
• fuzz/: a standalone cargo-fuzz crate with decode_scval, decode_envelope, and decode_event targets. These satisfy the fuzz-target dependency so the smoke job actually exercises the decoders rather than no-op.
• docs/TESTING.md: documents the local gate, how to run and add fuzz targets, the scheduled job, nightly pinning, and crash reproduction.

Verification

• Fuzz targets are not part of the main workspace (cargo metadata shows the four original members); the CI gate is unaffected.
• cargo fmt, cargo clippy --all-targets, and cargo test --all pass.
• Workflow YAML parses, and the target-discovery + multiline GITHUB_OUTPUT + bounded loop logic was executed locally in bash; it finds decode_envelope, decode_event, decode_scval and would run each for 60s.
• Note: the local Windows nightly toolchain is broken, so the targets were not linked/run locally; the job uses ubuntu-latest where cargo-fuzz is supported.