feat(build): fuzz testing and git-cliff changelog automation

Add FuzzParseBytes and FuzzSanitizeYAMLEscapes in internal/model/fuzz_test.go.
Both targets run as regular seed-based tests in CI (go test ./...) and can be
run continuously via `task fuzz` (default 30 s per target; FUZZ_TIME=60s to
extend). Fuzz corpus failures are saved to testdata/fuzz/ for regression.

Add cliff.toml configuring git-cliff to generate Keep-a-Changelog-compatible
release notes from Conventional Commits. New tasks: `task changelog`
(regenerate full CHANGELOG.md) and `task changelog-next` (preview unreleased
entries without writing). Requires git-cliff (brew/cargo install git-cliff).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Taskfile.yml

@@ -175,6 +175,20 @@ tasks:
     generates:
       - "{{.BINARY}}-{{.TAG}}-linux-amd64"
 
+  fuzz:
+    desc: "Run fuzz tests for the YAML parser and sanitizer (set FUZZ_TIME=60s to control duration, default 30s)"
+    cmds:
+      - "{{.GO}} test -fuzz=FuzzParseBytes          -fuzztime=${FUZZ_TIME:-30s} ./internal/model/"
+      - "{{.GO}} test -fuzz=FuzzSanitizeYAMLEscapes -fuzztime=${FUZZ_TIME:-30s} ./internal/model/"
+
+  changelog:
+    desc: "Regenerate CHANGELOG.md from git history (requires git-cliff — see README)"
+    cmd: git cliff --config cliff.toml --output CHANGELOG.md
+
+  changelog-next:
+    desc: "Preview unreleased changelog entries without writing (requires git-cliff)"
+    cmd: git cliff --config cliff.toml --unreleased
+
   clean:
     desc: Remove build artifacts
     cmd: rm -f {{.BINARY}} {{.BINARY}}-*.exe {{.BINARY}}-*-linux-amd64