test: add godog BDD suite and fuzz targets (#16)

[millerjp]

Summary

Closes Phase 4 by landing the BDD contract and fuzz layer. Mirrors axonops/mask's godog scaffolding and adds FuzzLoadStore + FuzzConcurrent for randomised input coverage.

Closes #16.

What's in this PR

File	State
tests/bdd/bdd_test.go	new — godog entry with Strict: true (mask template verbatim)
tests/bdd/steps/steps.go	new — step defs; World carried via context.WithValue; guarded type assertion in worldFrom
tests/bdd/features/syncmap.feature	new — 1 Feature, 15 Rules, 37 scenarios covering every public symbol + a concurrent Store scenario
syncmap_fuzz_test.go	new — FuzzLoadStore (round-trip) and FuzzConcurrent (4 goroutines, race-clean)
.github/workflows/ci.yml	bdd-strict-mode-guard job added (mask verbatim)
go.mod / go.sum	github.com/cucumber/godog v0.15.1 + transitives

Scenario coverage

Per Rule: Load ×3, Store ×2, LoadOrStore ×3, LoadAndDelete ×3, Delete ×3, Swap ×3, Clear ×2, Range ×3, Len ×2, Map ×1, Keys ×2, Values ×2, CompareAndSwap ×4, CompareAndDelete ×3, Concurrency ×1 = 37 scenarios.

Local validation

$ make test-bdd
ok github.com/axonops/syncmap/tests/bdd 1.399s  (37 scenarios, 111 steps)

$ go test -fuzz=FuzzLoadStore -fuzztime=1s ./...
… 75,000+ executions, no failures

$ go test -fuzz=FuzzConcurrent -fuzztime=1s ./...
… 22,000+ executions, no failures

$ make check
(14 gates green, coverage 100%, govulncheck clean)

$ actionlint .github/workflows/ci.yml
clean

Agent gates

• Plan — two-commit or single-commit; went with single commit since CI's bdd-strict-mode-guard job is only useful once the feature file + entry land (no split value).
• test-writer (pre) — produced the complete suite.
• code-reviewer (post) — ship it; 8 NITs; applied two (new param rename → from/to; removed unused World.err).
• security-reviewer (post) — flagged soft BLOCKING on unguarded worldFrom type assertion; fixed with comma-ok + explicit panic message.
• go-quality — 14/14 PASS.
• commit-message-reviewer — PASS.

Deferrals

• CHANGELOG — docs: add README, CHANGELOG, NOTICE, SECURITY, and LLM docs bundle #17.
• README note on tests/bdd/ — docs: add README, CHANGELOG, NOTICE, SECURITY, and LLM docs bundle #17.

Test plan

• All 14 CI jobs green (new BDD strict mode guard included)
• Coverage remains 100% on the main package
• Fuzz targets continue to pass in the test job (run implicitly via go test when -fuzz is not set — they run as unit tests)