test(contract): deterministic fuzz for conversion, fee, overflow (#74)

[woahwhattheheck]

Summary

Closes #74.

Adds a deterministic fuzz / property suite for share↔asset conversion, BPS (fee/rate) bounds, overflow rejection, and deposit/withdraw conservation — without weakening any existing invariant.

Harness

• Fixed seed FUZZ_SEED = 0x0059_5646_3734_2026 (LCG); same seed ⇒ same inputs in CI.
• On failure, assertions include seed + minimized inputs so a regression fixture can be cut without re-searching.
• Pure math fuzz: 2 048 iterations per suite; Env conservation loop: 8 seeded cases (keeps ledger snapshots thin).

Coverage

Suite	Property
fuzz_mul_div_floor_or_safe_reject	Floored a*b/d, or DivisionByZero / MathOverflow
fuzz_convert_round_trip_conserves_value	assets→shares→assets never mints value
fuzz_convert_shares_round_trip_conserves	shares→assets→shares never inflates shares
fuzz_convert_to_shares_monotonic	more assets ⇒ ≥ shares
fuzz_convert_to_assets_monotonic	more shares ⇒ ≥ assets
fuzz_share_fraction_bps_bounded	shares ≤ total ⇒ fraction ≤ bps (fee/rate bound)
fuzz_price_per_share_monotonic_in_assets	more assets ⇒ ≥ pps
fuzz_empty_vault_bootstrap_and_zero_totals	empty 1:1 bootstrap / zero redeem
fuzz_regression_fixtures_overflow_and_bounds	pinned overflow, floor, 100% BPS edges
fuzz_vault_deposit_withdraw_conserves_under_yield	full redeem ≤ deposit + funded yield

Design tradeoff

Kept the fuzz lane thin and high-confidence: focused on math.rs invariants plus a small Env conservation loop, rather than a sprawling stateful fuzzer. Fee/rate coverage maps to the existing BPS and price-per-share paths (no deposit-fee module exists today).

Tests

cargo test --locked
# 62 passed; 0 failed; 3 ignored (pre-existing)
cargo fmt --all -- --check
cargo clippy --lib --locked -- -D warnings

Compatibility

Test-only. No on-chain API or version() change.