ci: wire the test-tsan target

[SyntaxSawdust]

Summary

• Add a real test-tsan runner that builds with ThreadSanitizer and runs the
  mem, slab_alloc, and parallel suites by default.
• Compile grammar, runtime, LSP, preprocessor, and vendored dependencies into a
  separate tsan_* object family so the target does not reuse ASan/UBSan test
  objects.
• Add an Ubuntu CI job that installs clang and runs make -f Makefile.cbm test-tsan CC=clang CXX=clang++.

Why

Fixes #860.

make -f Makefile.cbm test-tsan was advertised and TSan flags existed, but the
target only printed a placeholder and exited successfully. That left the slab
allocator and parallel extraction concurrency coverage absent from the sanitizer
gate.

Tests

• make -f Makefile.cbm test-tsan - passed, 79 passed
• git diff --check - passed
• make -f Makefile.cbm lint-no-suppress - passed

Not fully run locally:

• make -f Makefile.cbm lint-ci - blocked because local cppcheck,
  clang-format, and clang-tidy are unavailable
• make -f Makefile.cbm test-foundation - existing unresolved-symbol link
  failure in that target's recipe; unrelated to this diff

Scope

• Scope is limited to Makefile.cbm and the reusable test workflow.
• No production allocator or parallel extraction behavior changes.
• No broader sanitizer policy changes beyond wiring the requested TSan target.

Caveats

• Local proof ran on macOS with the existing compiler defaults; the new CI leg
  runs the target on Ubuntu with clang.
• AutoReview could not complete in this local environment: sandboxed execution
  failed to start the nested proxy, and the unsandboxed rerun was rejected by
  tenant policy because it would send the unpublished local diff to an external
  review service.

[DeusData]

Thanks for wiring the real TSan target for #860. Triage: CI/stability bug, normal priority, draft PR.

Because this touches .github workflows and Makefile.cbm, review needs the normal high-caution build-infrastructure pass: no hidden build behavior changes, no sanitizer object reuse, deterministic Linux runner setup, and no broadening beyond the requested TSan gate. The scope statement is helpful.

[SyntaxSawdust]

Thanks for the guidance. I re-ran the high-caution pass before marking this ready: the diff remains limited to Makefile.cbm and .github/workflows/_test.yml, the TSan dry-run shows tsan_* objects with no ASan/UBSan object reuse, the Ubuntu job installs clang/zlib and invokes the target explicitly, and CI is green including test / test-tsan. No production allocator or parallel extraction behavior changed.