fix: address PR review — fuzz target fixes, UBSan, CI improvements

Critical fixes:
- Add missing #include <string.h> to 5 fuzz targets (wouldn't compile with GCC14+/Clang16+)
- Fix fuzz_metadata_from_buf.c OOB read: guard size >= sizeof(int) + FILE_METADATA_WIRE_SIZE
- Add Clang compiler check for ENABLE_FUZZ in CMakeLists.txt (fail fast at configure time)
- Add fuzz-build CI job (install clang, build all 6 fuzz targets with ENABLE_FUZZ=ON)

Warning fixes:
- Add UBSan to sanitizer CI matrix (address + undefined)
- Remove tautological test_property_glob_consistency (pure/deterministic function)
- Use fixed seed srand(42) instead of srand(time(NULL)) for reproducible property tests
- Add valid-header + truncated-instructions delta robustness test (exercises instruction-loop error paths)
- Fix lcov --remove to exclude '*/_deps/*' (xxhash coverage pollution)
- Add comment explaining FASTSYNC_UNDER_VALGRIND skip in test_file.c
- Update .gitignore for build-*/ directories

tests/fuzz/fuzz_chunk_deserialize.c

@@ -2,6 +2,7 @@
 #include "data.h"
 #include <stdint.h>
 #include <stdlib.h>
+#include <string.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   if (size == 0)

tests/fuzz/fuzz_compress_decompress.c

@@ -2,6 +2,7 @@
 #include "data.h"
 #include <stdint.h>
 #include <stdlib.h>
+#include <string.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   if (size == 0)

tests/fuzz/fuzz_delta_deserialize.c

@@ -2,6 +2,7 @@
 #include "data.h"
 #include <stdint.h>
 #include <stdlib.h>
+#include <string.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   if (size == 0)

tests/fuzz/fuzz_delta_signature_deserialize.c

@@ -2,6 +2,7 @@
 #include "data.h"
 #include <stdint.h>
 #include <stdlib.h>
+#include <string.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   if (size == 0)

tests/fuzz/fuzz_metadata_from_buf.c

@@ -2,9 +2,10 @@
 #include "file.h"
 #include <stdint.h>
 #include <stdlib.h>
+#include <string.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  if (size < sizeof(int))
+  if (size < sizeof(int) + FILE_METADATA_WIRE_SIZE)
     return 0;
 
   char* buf = malloc(size);

tests/test_file.c

@@ -272,6 +272,11 @@ void test_file() {
   test_to_disk_creates_dirs();
   test_file_content_to_buffer();
   if (!getenv("FASTSYNC_UNDER_VALGRIND")) {
+    // Fork tests are skipped under valgrind because the parent process runs
+    // orders of magnitude slower than the child (parent is instrumented, child
+    // is not), which causes pipe-based protocol handshake timeouts. The parent
+    // process itself has zero valgrind errors -- the failures are all in the
+    // forked children where inherited allocations are reported as leaks.
     test_file_send_receive();
     test_file_send_no_path();
   }

tests/test_property.c

@@ -10,7 +10,6 @@
 #include <stdlib.h>
 #include <sys/stat.h>
 #include <unistd.h>
-#include <time.h>
 
 static Data* random_data(int min_size, int max_size) {
   int size = min_size + rand() % (max_size - min_size + 1);
@@ -21,7 +20,7 @@ static Data* random_data(int min_size, int max_size) {
 }
 
 static void test_property_compress_roundtrip() {
-  srand((unsigned)time(NULL));
+  srand(42);
   for (int iter = 0; iter < 10; iter++) {
     Data* original = random_data(1, 10000);
     EXPECT_NOT_NULL(original);
@@ -114,24 +113,8 @@ static void test_property_chunk_roundtrip() {
   }
 }
 
-static void test_property_glob_consistency() {
-  const char* patterns[] = {"*.txt", "test_*", "*.c", "foo", "*.??", "a*b*c"};
-  const char* strings[] = {"test.txt", "foo.c", "bar", "abc", "aXbYcZ", ""};
-  int n_patterns = sizeof(patterns) / sizeof(patterns[0]);
-  int n_strings = sizeof(strings) / sizeof(strings[0]);
-
-  for (int p = 0; p < n_patterns; p++) {
-    for (int s = 0; s < n_strings; s++) {
-      bool first = glob_match(patterns[p], strings[s]);
-      bool second = glob_match(patterns[p], strings[s]);
-      EXPECT_TRUE(first == second);
-    }
-  }
-}
-
 void test_property() {
   test_property_compress_roundtrip();
   test_property_delta_roundtrip();
   test_property_chunk_roundtrip();
-  test_property_glob_consistency();
 }

tests/test_robustness.c

@@ -126,6 +126,35 @@ static void test_delta_signature_deserialize_truncated() {
   delta_signature_destroy(sig);
 }
 
+static void test_delta_deserialize_truncated_instructions() {
+  // Create a real delta with 2 LITERAL instructions, serialize, then
+  // truncate after the header so the instruction-loop error paths are
+  // exercised (earlier tests with tiny buffers die at the 12-byte
+  // header guard and never reach the instruction decoder).
+  char old_data[4096], new_data[4096];
+  for (int i = 0; i < 4096; i++) {
+    old_data[i] = (char)(i % 256);
+    new_data[i] = old_data[i];
+  }
+  // Two small changes to produce 2 LITERAL instructions
+  new_data[100] = 'X';
+  new_data[200] = 'Y';
+
+  DeltaSignature* sig = delta_signature_create(old_data, 4096, 1024);
+  Delta* delta = delta_compute(new_data, 4096, sig, 1024);
+  Data* serialized = delta_serialize(delta);
+  EXPECT_NOT_NULL(serialized);
+
+  // Truncate to include the header (12 bytes) + partial first instruction
+  serialized->size = 14;
+  const Delta* result = delta_deserialize(serialized);
+  EXPECT_NULL(result);
+
+  data_destroy(serialized);
+  delta_destroy(delta);
+  delta_signature_destroy(sig);
+}
+
 static void test_delta_apply_null() {
   const void* result = delta_apply(NULL, 0, NULL, 0);
   EXPECT_NULL(result);
@@ -177,6 +206,7 @@ void test_robustness() {
   test_delta_deserialize_truncated();
   test_delta_deserialize_empty();
   test_delta_deserialize_garbage();
+  test_delta_deserialize_truncated_instructions();
   test_delta_signature_deserialize_truncated();
   test_delta_apply_null();
   test_protocol_receive_n_data_closed_pipe();