P2: Fuzz the SSH command parser, Git HTTP routing, and the LFS pkt-line parser

Why

Three hand-written parsers run on bytes an anonymous client controls, and each is covered only by table tests:

• splitCommand in server/ssh/server.go turns an exec line from an unauthenticated connection into an argv, and refuses only what exceeds 4 KiB.
• The request and route parsing in server/githttp decides which service, repository, and ref a request names.
• The pkt-line reader in core/lfs/transfer.go turns a stream from a pusher into lengths and bodies.

A panic in any of them crashes the process that serves every repository, and a mis-parse in the first is the first step into the Git command line.

Scope

• Fuzz splitCommand: empty arguments, quotes that never close, escapes, NULs, invalid UTF-8, and the 4 KiB boundary. Assert no panic, and that splitting is total for every input it accepts.
• Fuzz Git HTTP request and route parsing: service= values, info/refs, percent-encoded traversal, over-long paths, repeated query parameters.
• Fuzz the LFS pkt-line reader: bad lengths, a 0000 flush in the wrong place, truncated bodies, and declared lengths far beyond the data.
• Seed each target from the existing table tests, so go test ./... runs the corpus in verify and a fuzz target costs nothing on a normal push.
• Document the longer budget as a local command, next to the race-test note in CONTRIBUTING.md.

Acceptance

• go test ./... runs each target’s seed corpus.
• Each target survives a documented one-minute run without a finding, and the command is in CONTRIBUTING.md.
• Anything these turn up keeps the failing input as a seed and a regression test.

Part of #14.