🧪 Fuzz parser totality against hostile input

[ccamel]

Summary

NewParser accepts arbitrary rune input through io.RuneReader in engine/parser.go:31-54, while engine/parser_test.go:24-230 provides a finite table corpus. The parser must return a term or error for hostile input without panicking.

Why it matters

Parser panics turn malformed source into a host failure rather than a Prolog parse error and can expose untested lexer-parser state transitions.

Scope

Add engine/parser_fuzz_test.go with FuzzParser. Use a fresh zero VM and parser for each input, bound inputs to 8 KiB, and seed "", "foo.", "[", "'don''t panic'.", "9223372036854775808.", and "tag{x:}.".

Acceptance criteria

• FuzzParser creates a fresh zero VM and parser for every fuzz input.
• Inputs longer than 8 KiB are skipped or otherwise bounded before parsing.
• The seed corpus contains all six specified inputs.
• Every seed and fuzz input returns a term or error without panicking.
• A 30-second fuzz run completes without a panic.

Verification

Run the seed corpus through go test ./engine -run '^FuzzParser$' and run go test ./engine -run '^$' -fuzz '^FuzzParser$' -fuzztime=30s; both commands must complete without a panic.