Add an AddressSanitizer CI job #162

There is no sanitizer configuration anywhere in the tree, against 200+ raw new/delete sites in src/*.cpp. I built one to see what it would report.

ForeFire is clean of memory errors today, and leaks about 200 kB per simulation.

runff still passed both verifications under ASan. No use-after-free, no buffer overflow, no double free, on either the model arithmetic path or the full simulation path — so an ASan job can go in as a blocking CI check immediately, with no backlog to clear first.

- name: Unit tests under AddressSanitizer
  run: |
    cmake -S . -B build-asan -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_CXX_FLAGS="-fsanitize=address -g -O0"
    cmake --build build-asan -j
    ASAN_OPTIONS=detect_leaks=0 ctest --test-dir build-asan --output-on-failure

detect_leaks=0 is deliberate: errors blocking, leaks informational. The leak counts above are dominated by #159 — nothing owns a PropagationModel, so ASan reports every one as leaked. Turning leak detection on before that lands gives a permanently red job that everyone learns to ignore. Flip it once #159 is fixed, and the 200 kB becomes a regression check.

The unit suite is the natural vehicle: under a tenth of a second, constructs and destroys all 33 models, no fixtures.

For precedent: the double free fixed in #157 was found by writing a destructor test and confirmed by glibc aborting with double free or corruption. ASan reports the same class of bug with full allocation and free stack traces, and would have found it immediately.

UBSan is worth adding alongside, but was not measured here — the toolchain I had could not link it, so I am not claiming it comes back clean.

Drafted by Claude Opus 5 from a codebase audit. Reviewed by a maintainer before filing.

EDIT: rewrote for human readability.