test(agent): WAL property tests, crash-recovery matrix, WAL fuzz target

- tests/wal_properties.rs — deterministic generator, reproducible by seed:
  everything appended is read back intact (300 cases), and after ANY damage
  to the file (bit flips, truncation, inserted/deleted bytes, duplicated or
  rotated regions, overwritten ranges; 1500 cases) reading never panics and
  yields an exact prefix of what was written — the guarantee the chained CRC
  exists to give. Opening for append then repairs the tail and a new entry
  lands right behind the surviving prefix.
- tests/crash_recovery.rs — builds the on-disk images a process crash can
  leave and reopens each against a model of what was acknowledged: an image
  after every operation (random saves, in-place updates, checkpoints, small
  wal_max_entries), the checkpoint window (new .h5 + not-yet-truncated WAL)
  over several rounds, and the WAL torn at every byte length, which must
  recover the checkpoint plus a prefix of the operations logged since.
- fuzz/fuzz_wal_replay — arbitrary bytes as a WAL: read and open-for-append
  must not panic, and open() must not change what is replayable. Based on the
  target from the clawmates mission branch (4aee2fa), with the repair
  property added. The CI fuzz step now covers both fuzz crates.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

crates/clawhdf5-agent/fuzz/fuzz_targets/fuzz_wal_replay.rs

@@ -0,0 +1,36 @@
+#![no_main]
+//! Arbitrary bytes as a WAL file. Reading, and opening for append (which scans
+//! the chain and truncates an unverifiable tail), must never panic, hang, or
+//! allocate without bound — and after `open` repairs the file, everything
+//! `read_entries` returned before must still be returned.
+//!
+//! The deterministic counterpart that runs in ordinary CI is
+//! `tests/wal_properties.rs`; this target explores inputs it cannot reach.
+
+use std::io::Write as _;
+
+use clawhdf5_agent::wal::WalFile;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(mut tmp) = tempfile::NamedTempFile::new() else {
+        return;
+    };
+    if tmp.write_all(data).and_then(|()| tmp.flush()).is_err() {
+        return;
+    }
+    let before = WalFile::read_entries(tmp.path()).map(|e| e.len());
+    // Only the chained formats (header versions 3 and 4) are repaired in
+    // place. `open` deliberately recreates a legacy-format file from scratch:
+    // `HDF5Memory::open` has already replayed its entries by then.
+    let chained = matches!(data.get(4), Some(3 | 4));
+    let opened = WalFile::open(tmp.path());
+    if !chained {
+        return;
+    }
+    if let (Ok(before), Ok(wal)) = (before, opened) {
+        drop(wal);
+        let after = WalFile::read_entries(tmp.path()).map(|e| e.len());
+        assert_eq!(after.ok(), Some(before), "open() changed what is replayable");
+    }
+});