merge: resolve main into jwx-v4-cutover

Keep v0.6.1 internal-docs index entries and FUZZ.md from main; document
foreign-JWS fuzz targets in the playbook.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: yaronf

.github/workflows/test.yml

@@ -15,3 +15,25 @@ jobs:
           cache: false
       - name: Test
         run: go test ./...
+
+  fuzz:
+    runs-on: ubuntu-latest
+    env:
+      GOTOOLCHAIN: local
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.27'
+          cache: false
+      - name: Fuzz smoke
+        # Short per-target budget (~75s total). See internal-docs/FUZZ.md.
+        run: |
+          set -euo pipefail
+          for target in FuzzVerifyRequest FuzzVerifyViaMessage FuzzSignAndVerifyHMAC FuzzHMACViaMessage FuzzNewMessage; do
+            echo "::group::fuzz $target"
+            go test -run='^$' -fuzz="$target" -fuzztime=15s .
+            echo "::endgroup::"
+          done

CLAUDE.md

@@ -62,7 +62,7 @@ Optional foreign JWS uses `lestrrat-go/jwx/v4` via `NewJWSSigner` / `NewJWSSigne
 ### Testing conventions
 
 - `signatures_test.go` contains the full RFC 9421 test vector suite (134 KB) — do not modify without understanding the spec.
-- `fuzz_test.go` has fuzz entry points; seed corpus lives in `testdata/fuzz/`.
+- `fuzz_test.go` has fuzz entry points (`FuzzVerifyRequest`, `FuzzVerifyViaMessage`, `FuzzSignAndVerifyHMAC`, `FuzzHMACViaMessage`, `FuzzNewMessage`); see [internal-docs/FUZZ.md](internal-docs/FUZZ.md). Seed corpus: `f.Add` plus optional `testdata/fuzz/`.
 - `http2_test.go` and `trailer_test.go` cover HTTP/2 and trailer-header edge cases.
 - Tests use `github.com/stretchr/testify` assertions and `github.com/andreyvit/diff` for readable diffs.