security: ClusterFuzzLite fuzzing of the composed gate (Scorecard Fuzzing #10)

[askalf]

What

Adds ClusterFuzzLite continuous fuzzing, resolving the OpenSSF Scorecard Fuzzing alert (#10, medium). The three tools are each fuzzed in their own repos; this fuzzes the piece that was missing — the integration.

Two Jazzer.js targets exercise this repo's own code with arbitrary bytes:

Target	Invariant under test
fuzz/composed_gate.fuzz.js	guardedCall (a) never throws into the agent on arbitrary action input, and (b) fails closed — proceeds (ok:true) only when redstamp itself would allow. A proceed on a non-allow verdict = a fail-open composition bug.
fuzz/egress_host.fuzz.js	egressHost() — the parser deciding which host a secret may be redeemed toward — never throws and always returns string | null.

composed_gate builds the vault/lock/pinned-tool once at module load and reuses a high-use lease, so each exec is O(1) and the fuzzer covers the orchestration, not setup.

Wiring (mirrors the fleet / redstamp pattern)

• .clusterfuzzlite/Dockerfile — OSS-Fuzz JS base builder, pinned by digest
• .clusterfuzzlite/build.sh — installs the project's runtime deps first (the targets import the composed gate → @askalf/* + MCP SDK), then merges in hash-pinned Jazzer.js; Jazzer never enters package.json
• .clusterfuzzlite/{package,package-lock}.json — fuzz-only Jazzer manifest, integrity-verified by the committed lockfile
• .github/workflows/cflite.yml — weekly (Mon 04:23 UTC, off the :00 grid) + workflow_dispatch; SHA-pinned actions; a crash fails the job and uploads the reproducer
• .gitattributes — pins *.sh to LF so a Windows re-commit can't CRLF-break build.sh in the Linux container
• npm run fuzz — runs every target locally (FUZZ_SECONDS to tune)

Verification

Both targets run clean locally under Jazzer.js:

• egress_host — ~45k runs, no crash
• composed_gate — ~1.2k runs (FS-stateful), no crash; the fail-closed assertion held on all inputs

No change to runtime/public API. npm test unaffected (fuzz targets are not part of the test run).

[askalf]

Two notes for review

1. ssh→https for the git deps (2nd commit). The root lockfile resolves @askalf/* to git+ssh://git@github.com URLs. GitHub-hosted runners clone those fine (that's why ci.yml is green), but the ClusterFuzzLite build runs inside the OSS-Fuzz base-builder container, which has no SSH key — so build.sh rewrites ssh→anonymous https via git config insteadOf before npm ci (public repos, shared lockfile untouched). Verified locally with GIT_SSH_COMMAND=false: the ls-remote succeeds through the rewrite and fails without it.

2. The OSS-Fuzz build runs first after merge. cflite.yml triggers on schedule + workflow_dispatch only, and workflow_dispatch keys off the default branch — so the fuzz build (the OSS-Fuzz Docker image + npm ci in-container) can't execute on this PR. I've de-risked every piece I can locally: both fuzz targets run clean under Jazzer.js, both npm ci calls + the Jazzer merge succeed, and the ssh→https rewrite is proven. After merge, kick the tires with:

gh workflow run cflite.yml --repo askalf/agent-security-stack

If the in-container build ever needs a nudge, the two usual levers are the base-image digest (.clusterfuzzlite/Dockerfile) and the git-dep clone (handled above).