test: add fuzzing harness and fee-payer property tests

[dev-jodee]

Summary

• Add a standalone cargo-fuzz workspace (fuzz/) with two libFuzzer targets over Kora's untrusted transaction-input paths: parse_transaction (bytes → VersionedTransaction → the get_or_parse_* instruction parsers) and decode_b64_transaction (the RPC base64 decode entry point).
• Add a proptest fee-payer drain invariant across the System-program policy matrix: the fee payer is gated in a role exactly when its policy flag is off, and non-fee-payer actors are never gated. Targets the pure, RPC-free validate_fee_payer_usage.
• Raise kora-lib recursion_limit to 256 so the cargo-fuzz sanitizer build compiles (an async-block layout query overflows the default 128; harmless for normal builds).
• Add just fuzz / fuzz-build / fuzz-list recipes and a fuzz/README.md.

Why not Crucible

Crucible fuzzes on-chain sBPF via LiteSVM edge tracing. Kora's validator, fee-payer policy, and instruction parsers are native off-chain Rust, so Crucible yields no coverage signal there. cargo-fuzz (byte-level) + proptest (structural invariants) fit the native surface.

Test Plan

• cargo test -p kora-lib --lib fee_payer_policy_props — 512 cases pass.
• cargo install cargo-fuzz && just fuzz-build — both targets build under the sanitizer.
• just fuzz parse_transaction / just fuzz decode_b64_transaction — smoke-ran ~158k / ~122k executions at ~7.8k exec/s, no crashes.

Notes

• fuzz/ is its own workspace so sanitizer RUSTFLAGS don't leak into the main build; target/, corpus/, artifacts/ are gitignored.
• Follow-ups (not in this PR): extend the property test to SPL / Token-2022 roles, and add an economic-invariant property (max_allowed_lamports never exceeded) using the RPC mock harness.

[greptile-apps]

Greptile Summary

The PR adds native transaction fuzzing and strengthens fee-payer policy property testing.

• Adds standalone cargo-fuzz targets for transaction parsing and base64 decoding.
• Adds property tests covering System-program fee-payer roles, including both CreateAccount account positions.
• Adds fuzzing recipes, documentation, dependencies, and the compiler recursion-limit adjustment required by sanitizer builds.

Confidence Score: 4/5

The PR appears safe to merge, although the previously reported lookup-table fuzz coverage gap remains.

The CreateAccount property-test omission has been fixed, while the parser fuzz target still uses a static-key-only constructor that returns before parsing lookup-table-backed instructions; this limits test coverage but does not alter production behavior.

Files Needing Attention: fuzz/fuzz_targets/parse_transaction.rs

Important Files Changed

Filename	Overview
fuzz/fuzz_targets/parse_transaction.rs	Adds parser fuzzing, but the previously reported lookup-table coverage gap remains outstanding.
fuzz/fuzz_targets/decode_b64_transaction.rs	Exercises the RPC transaction decoder with arbitrary lossy UTF-8 strings.
crates/lib/src/validator/transaction_validator.rs	The updated property generator now independently exercises fee-payer use in both CreateAccount roles.
fuzz/Cargo.toml	Defines an isolated cargo-fuzz workspace and both fuzz binaries.
justfile	Adds recipes for running, building, and listing fuzz targets.

_{Reviews (3): Last reviewed commit: "test: cover fee-payer-as-new-account in ..." | Re-trigger Greptile}