Give the propagation models and layers an owner

[HugoFara]

Closes#159. Building and destroying a FireDomain with a propagation layer cost about 183 kB every time, linearly and without limit.

Measured over 500 domains, each attaching a Rothermel layer:

	RSS growth	occupied model slots
before	91,504 kB	never released
after	180 kB	back to zero after each domain

The part that is not a leak

While reproducing this I found the reason nobody could simply add the missing delete: the FireDomain constructor wiped both static model tables.

for ( size_t i = 0; i < NUM_MAX_PROPMODELS; i++ ) propModelsTable[i] = 0;
for ( size_t i = 0; i < NUM_MAX_FLUXMODELS; i++ ) fluxModelsTable[i] = NULL;

propModelsTable is static and shared by every domain in the process, so building a second domain dropped the first one's registrations. Demonstrated:

step	propModelsTable
A created + layer	49 = 0x3389c890
B created, no layer yet	empty — A's model is gone
B created + layer	49 = 0x33c80b30

A's PropagativeLayer still holds index 49 throughout. Between the second and third rows that index is null, and FireDomain.cpp:1349 dereferences it without checking. After the third row it resolves to B's model, so A propagates using another domain's parameters — silently, with wrong spread rates rather than a crash.

Command.cpp:205 builds exactly that second domain for coupled runs.

The wipe is gone. Both tables are static storage and already start out null, and each domain now records the entries it registered and releases exactly those — before the data broker, since the models hold a pointer to it.

Also on this path

• getFreePropModelIndex counted down through an unsigned index with no lower bound. A full table wrapped to SIZE_MAX and read far out of bounds. getFreeFluxModelIndex bound-checked but then returned an occupied index, silently overwriting a live model. Both now report and return an out-of-range value their callers refuse. This was reachable only once the tables could fill up, which is to say: only after this change.
• DataBroker::addConstantLayer allocated an array, handed it to a layer that copies it, and dropped it.FFArray's matrix constructor does data = new T[size] and copies element by element, so the caller's array is never adopted. Both delete[] data; lines were sitting there commented out, one per branch.

The leak gate is now on

This is what #162 was waiting for. Under ASan the unit suite goes from 4.7 MB leaked to none, so sanitizers.yml now runs it with detect_leaks=1 as a blocking check.

runff still leaks ~200 kB over 783 allocations, on paths a full simulation reaches and the unit suite does not, so its leak check stays informational. Closing those is what would let it join the gate.

Verification

• Unit suite 5/5, including tests/unit/test_domain_ownership.cpp (new): the release, the cross-domain clobbering, and a 40-domain loop.
• Negative controls, one per half of the fix. Restoring the constructor wipe fails the clobbering case; removing the release call fails the slot case. Neither passes with the bug present.
• runff: KML and NetCDF both match within tolerance.
• ASan in ubuntu:24.04: zero errors, unit suite leak-free, runff passing.

One test changed shape

every model can be destroyed used to delete model by hand. That is a double free now that the domain owns them, so each model takes its own sandbox and destroying the sandbox is the destruction under test — which is how destruction actually happens in a run. Its comment claiming "nothing deletes a model in a normal run" was true when written and is not any more.

---

This pull request, including its code changes and this description, was generated by Claude Opus 5, and reviewed manually before submitting.