feat(fuzz): add state KV decode fuzz target with roundtrip check

[wangzishuai1987]

Summary

Adds a fuzz_store_decode fuzz target that feeds arbitrary bytes into the state KV decoding logic (mirroring grey_store::decode_state_kvs).

What it tests:

• Decoding arbitrary bytes never panics — only Some or None
• Successful decode roundtrips through re-encode → re-decode
• Includes the same OOM guard as the real implementation (bounding count by remaining bytes / 35)

Why it matters:
decode_state_kvs parses untrusted data from the database. A panic here would crash the node. This fuzz target ensures the decoder handles all edge cases including:

• Truncated count prefix
• Oversized count prefix (OOM attack vector)
• Truncated keys or value lengths
• Zero-length values
• Values spanning to the end of input

Refs: #229

[github-actions]

Genesis Review

Comparison targets:

• 204e93ab (204e93a)
• 9b74f920 (9b74f92)
• 34d3e3e3 (34d3e3e)
• 8a8aa7e0 (8a8aa7e)
• 9eb20371 (9eb2037)
• 4b62216e (4b62216)
• 50581174 (5058117)

How to review

Post a comment with the following format (rank from best to worst):

/review
difficulty: <commit1>, <commit2>, ..., <commitN>, currentPR
novelty: <commit1>, <commit2>, ..., <commitN>, currentPR
design: <commit1>, <commit2>, ..., <commitN>, currentPR
verdict: merge

Use the short commit hashes above and currentPR for this PR.
Each line ranks all comparison targets + this PR from best to worst.

To meta-review another reviewer's comment, react with 👍 or 👎.

[johandroid]

/review
difficulty: 204e93a, 9b74f92, 8a8aa7e, 9eb2037, 34d3e3e, 4b62216, currentPR, 5058117
novelty: 9b74f92, 8a8aa7e, currentPR, 204e93a, 9eb2037, 34d3e3e, 4b62216, 5058117
design: 204e93a, 9b74f92, 9eb2037, 8a8aa7e, 34d3e3e, 4b62216, 5058117, currentPR
verdict: notMerge

The intent is useful, but the fuzz target reimplements grey_store::decode_state_kvs instead of exercising the production decoder, and its copy adds an OOM guard that the production function does not have. That means the target can pass while the real decoder regresses or remains vulnerable, so design ranks last despite some novelty as fuzz coverage. Fix by testing the actual decoder, or exposing a narrow internal test/fuzz entry point.

[github-actions]

JAR Bot: Review recorded from @johandroid (1 reviews, 0 meta-reviews).
Merge weight: 0/37665 (need >50%).