Add code quality tooling: clang-tidy, sanitizers, coverage (#3046)

- Export compile_commands.json for tooling
- .clang-tidy: clang-analyzer + bugprone + cert checks scoped to src/,
  with stylistic/false-positive-prone checks disabled
- ENABLE_SANITIZERS CMake option (ASan + UBSan)
- ENABLE_COVERAGE CMake option with an lcov/genhtml 'coverage' target
- CI: asan job (ctest + stress test under ASan/UBSan), clang-tidy job
  (warning-count ratchet, baseline 29 with pinned clang-tidy-18),
  coverage job (lcov summary + HTML report artifact)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -15,6 +15,7 @@
 
 # Ignore files generated by configure
 build/
+build-*/
 .deps/
 /Makefile
 src/Makefile