Add a blocking AddressSanitizer job

[HugoFara]

Closes#162. Adds an AddressSanitizer job that blocks on errors from the day it lands, plus the build option that makes the same build reproducible locally.

Why it can be blocking immediately

ForeFire reports zero ASan errors on both test paths — no use-after-free, no overflow, no double free. There is no backlog to clear before switching this on, which is unusual and worth capturing before it stops being true. The state refactor in #175 will start moving allocations around; better to have the check in place first than to add it afterwards and discover what changed.

Verified in ubuntu:24.04, which is what ubuntu-latest runs

Step	Result
build with -fsanitize=address	clean
unit suite, detect_leaks=0	4/4 pass, 0 errors
runff, detect_leaks=0	passes, KML and NetCDF both match
leak report, detect_leaks=1	exits 8, ~4.7 MB reported

Negative control. A green job proves nothing unless it can go red, so I reintroduced the double free fixed in #157 into ForeFireV1HeatFluxModel and rebuilt:

==1214==ERROR: AddressSanitizer: attempting double-free on 0x50600000a400 in thread T0
SUMMARY: AddressSanitizer: double-free in operator delete[](void*)
75% tests passed, 1 tests failed out of 4

So the job catches the class of bug this project has actually had, with a full allocation and free stack trace rather than glibc's bare abort.

Leaks are deliberately not blocking

ASAN_OPTIONS=detect_leaks=0 on the two gating steps. Nothing owns a PropagationModel (#159), so ASan reports every one as leaked — the last row of the table is what the job would look like with leak detection on. A permanently red job is a job everyone learns to ignore, which is the same failure mode as the ERROR:-prefixed messages in #165.

The leak count still runs, as an informational step with continue-on-error, so the figure stays visible in the log and can be made blocking once #159 lands. At that point ~4.7 MB becomes a regression check rather than a known quantity.

FOREFIRE_SANITIZE as a build option

-DFOREFIRE_SANITIZE=address rather than raw CMAKE_CXX_FLAGS in the workflow, so anyone can reproduce a CI failure with one flag. It reaches the compile line, the executables and the shared library — the core is where the allocations happen, so linking it without the library would miss most of them.

It also switches the optimisation flags to -g -O1 -fno-omit-frame-pointer. The default non-MPI set is -O3 -flto -fomit-frame-pointer -finline-functions -funroll-loops, which strips exactly what a sanitizer needs for a readable stack trace. That is why this is a separate workflow rather than a job in main.yml: install-forefire.sh builds with the release flags.

Other values pass straight through — undefined, or address,undefined — but only address is verified clean here, so nothing claims UBSan is quiet.

---

This pull request, including its code changes and this description, was generated by Claude Opus 5, and reviewed manually before submitting.

[HugoFara]

Sanitizer only, merging.