### Coverage-guided fuzzing of the reader

`wai-rs/fuzz/` adds four libFuzzer targets, built by cargo-fuzz with AddressSanitizer:
- `envelope`: the `WAI1` and `WAI2` readers and the listing form;
- `int_payload`: every integer capability, against the committed parameter sets;
- `media`: the decoders of the floor and the recommended set;
- `containers`: the extension containers.

They are seeded from the repository's own vectors. `wai-fuzz.yml` runs each target for
15 minutes every night and keeps the corpus between runs; it never runs on a pull
request. `fuzz/run.sh` runs the same targets anywhere a nightly toolchain is installed.
SECURITY.md now says what is fuzzed and what is not.

- **Found and fixed.** In its first seconds, `containers` found the audio scene reader
  reserving entries for a `u32` count read from the input, before it read one: 48 GiB
  asked for by a few bytes. The world, reel, score, haptic and splat4d readers did the
  same. Each now reserves no more than its remaining bytes could hold.
  `tests/container_reservations.rs` rewrites a committed vector of each to declare
  2³² − 1 entries in four bytes and requires a refusal with no allocation past a few
  megabytes; on the old readers the world asset table alone asked for 256 GiB.

