Summary

Adds a manually dispatched workflow that rebuilds every extension with AddressSanitizer and runs the parser fuzz suite under it, plus a CI gate so a failed run blocks pull requests until it is green again.

Details

• asan.yml builds with -fsanitize=address, preloads libasan, and runs tests/test_fuzz_incoming.py and tests/test_protocol.py with the deep HYPOTHESIS_PROFILE=long profile by default; a ci profile input is available for a quick run
• an out of bounds read in the compiled parser is silent without a sanitizer, since small heap overreads rarely fault and the pure python fallback turns every miss into a caught IndexError; ASan redzones turn even a one byte overread into an abort
• the asan-status job in the main CI reads the most recent completed run on master and fails if it concluded in failure; a never run or cancelled state passes
• the same setup validated the parser changes locally in a Linux container; 50k hostile packets plus every boundary packet from the bounds audit ran clean

Test plan

• both workflow files parse as valid yaml; pre-commit clean
• the harness and flags are the ones proven working in the container run
• dispatch the workflow once after merge to seed a green status