P2: Fuzz the metadata and workflow parsers

Why

A push decides how much of this code runs, and none of it is fuzzed:

• metadata/frontmatter.go and the issue, request, comment, and release parsers turn repository bytes into the objects every page renders.
• ci/validate.go decodes workflow and image YAML with yaml.v3 into typed structs, and the same file decides what a job may name.

Both accept input from anyone allowed to push. A panic is an outage; a decoder that allocates without bound is an outage a small file causes.

Scope

• Fuzz the metadata document parser: missing or duplicated frontmatter delimiters, duplicate keys, non-UTF-8 bytes, huge single values, deeply nested lists.
• Fuzz workflow and image YAML decoding: unknown fields, anchors and aliases (including the alias-expansion bomb), wrong types, deep nesting, and documents at the repo_max_metadata_bytes boundary.
• Assert the useful properties, not just “no panic”: a parse either fails with an error or produces a value that re-encodes to an equivalent document, and no input allocates beyond the size bound.
• Seed from the existing tests and document the local fuzz budget, as for the transport parsers.

Acceptance

• go test ./... runs each target’s seed corpus.
• Each target survives a documented one-minute run without a finding.
• A hostile YAML document that would expand unboundedly is refused, and the refusal has a test.

Part of #14.