Implement validated layout encoding, decoding, and fuzzing #10

Outcome

Implement the canonical layout protocol with strict parse-validate-admit boundaries.

Dependencies

Blocked by #8 and #9.

Acceptance criteria

• Raw decoding cannot directly construct a trusted validated layout.
• Encoding matches checked-in golden bytes exactly.
• Decoding rejects trailing bytes, duplicate fields, noncanonical integers, unsupported versions, unknown mandatory flags, invalid order, excessive depth, and configured bound violations.
• Cross-field validation checks logical length, chunk count, aggregate chunk length, chunk identities, and layout identity.
• Every allocation is preceded by validated limits and checked conversion.
• Errors preserve expected and observed values without exposing plaintext.
• Corruption mutations cover every structural field.
• A continuous fuzz target exercises decoder and validator.
• Every discovered fuzz defect becomes a permanent regression fixture.
• No dependency-owned type leaks into the public API.

Required evidence

Golden fixtures, independent mutation fixtures, property tests for canonicality, and a documented fuzz invocation.