Harden configuration boundaries with fuzz coverage

docs/development.md

@@ -72,3 +72,14 @@ Once code exists, use focused checks while iterating and validation proportionat
 to the change under the testing policy. Documentation-only work does not require
 Go checks unless it changes behavior-bearing examples or commands they validate.
 Release validation is a separate, stricter gate governed by release policy.
+
+## Fuzz validation
+
+Run the bounded fuzz targets independently from the repository root. These exact
+commands keep each campaign short and constrain concurrent workers:
+
+```sh
+go test . -run='^$' -fuzz='^FuzzParsePath$' -fuzztime=30s -parallel=2
+go test ./internal/yaml -run='^$' -fuzz='^FuzzParseDocument$' -fuzztime=30s -parallel=2
+go test . -run='^$' -fuzz='^FuzzCompositionAndOverlay$' -fuzztime=30s -parallel=2
+```