Phase 1 of #149: make the failures visible - #151

Ships Phase 1 of the deep-audit plan of action from #149 -- CI/tooling
infrastructure and a new regression test that surface the failures
Phase 2 needs to fix, without fixing any of them yet.

- E1: add -Wall -Wextra -Werror to the dedx_objects library target
  (GCC/Clang; MSVC's /W4 baseline is a separate, unverified pass left
  for later). Clears the 8 live -Wsign-compare warnings by widening
  loop counters that are only ever compared against unsigned bounds
  (elements_length, stopping_data.length, etc.) to unsigned int, plus
  2 -Wunused-parameter warnings in the Bethe evaluators by casting the
  genuinely-unused `err` parameter to void -- both evaluators are pure
  arithmetic and never set it (tracked for de-duplication in #149 E3).
  No behavioural change; full suite still green.

- E2: add a `sanitize` CMake preset (-fsanitize=address,undefined) and
  a new `sanitize` CI job that builds and runs the full ctest suite
  under it. Extend the existing Valgrind job from a single test binary
  (test_bethe_ext00) to every test_* binary, with one deliberate
  exception (see below).

- E2: add tests/test_availability_exhaustive.c, sweeping every
  (program, ion, material) triple dedx_get_material_list_for_ion()
  advertises (skipping DEDX_ESTAR, which is unimplemented) and
  checking dedx_load_config() succeeds, the program/ion's own
  advertised energy bounds are accepted, and at least one sampled
  energy returns a finite, positive value. This reproduces the exact
  counts from #149's manual audit: 101957 combinations swept, 407
  load failures, 1568 bound mismatches, 174 configs that load
  successfully but return ENERGY_OUT_OF_RANGE at every energy --  the
  regression net for findings A1/A4/A5/A6. The test asserts each count
  stays at or below that known baseline (a ratchet, not a pass/fail
  on zero) so the tree stays green now; Phase 2 must lower the
  baselines as each root cause is fixed. At ~102k load/query cycles
  this takes ~15s natively / ~25s under ASan+UBSan, but 15+ minutes
  under Valgrind for near-zero incremental coverage over the other
  test_* binaries already exercising the same code paths there, so
  it's excluded from the Valgrind job specifically (with a comment
  explaining why) while staying in the plain and sanitize suites.

Verified locally: full ctest suite (33/33) green under a plain build,
under -Wall -Wextra -Werror, under ASan+UBSan, and under Valgrind
(leak-check=full, track-origins=yes) for every test_* binary except
the one documented exception above. clang-format and clang-tidy clean
on all changed/added files.

CodeQL's Actions analysis flags ci.yml for not declaring an explicit
permissions block, leaving GITHUB_TOKEN at its default (broader)
permissions for every job in the file. None of ci.yml's jobs need
anything beyond reading the checkout -- no PR comments, no pushes, no
releases -- so add contents: read, matching the same pattern already
used in cpp-examples.yml.

Note: the same gap exists in build-android.yml, build-linux-packages.yml,
build-windows.yml, clang-format.yml, clang-tidy.yml, coverage.yml and
docs.yml, left out of scope here since this PR only touches ci.yml.

- tests/test_availability_exhaustive.c: sweep_one() now checks
  dedx_allocate_workspace()/calloc() for NULL before dereferencing ws/
  cfg. An allocation failure is now a hard, unconditional test failure
  (stats->alloc_failures, reported and asserted separately from the
  A1/A4/A5/A6 baselines, which allow known counts) with a clear
  message, instead of a potential segfault.

- .github/workflows/ci.yml: the Valgrind loop now uses `shopt -s
  nullglob` and asserts at least one test binary ran, so the job can
  no longer silently "pass" having valgrinded nothing if the glob
  matches no files (e.g. tests didn't get built, or the path changes).
  Also pulled the single hardcoded exclusion (test_availability_exhaustive)
  out of an inline `if` into a named, documented SKIP_VALGRIND array,
  so a future exemption is a one-line addition instead of a new
  special case in the loop body.

- src/CMakeLists.txt: the GCC/Clang warnings-as-errors guard now also
  excludes MSVC, so it can't match clang-cl (CMAKE_C_COMPILER_ID is
  "Clang" there too, but it's the MSVC-compatible driver where GCC-style
  -Wall/-Wextra/-Werror aren't the right flags).

Verified locally: full ctest suite (33/33) still green after a clean
rebuild; clang-format clean on the changed .c file; the new Valgrind
loop logic checked standalone against both a populated and an empty
build/tests/ directory (skips exactly the one exempted binary in the
first case, hard-fails with a clear message in the second).

Addresses a Copilot review suggestion on 8976400 (suppressed as
optional/non-blocking, but worth taking): -Werror was unconditional on
the dedx_objects target, so *every* source build -- Release, the
.deb/.rpm packaging jobs, and any downstream/distro build -- would
hard-fail the moment a newer or different GCC/Clang introduced a new
-Wall/-Wextra diagnostic in code that hasn't actually regressed. This
also better matches what issue #149's E1 finding actually recommended:
"-Wall -Wextra ... on the library target, -Werror in CI" -- two
different scopes, which the previous commit conflated.

- New option(DEDX_WERROR "Treat compiler warnings as errors (GCC/Clang
  only)" OFF) in the top-level CMakeLists.txt, OFF by default.
- src/CMakeLists.txt: -Wall/-Wextra stay unconditional (GCC/Clang, not
  MSVC); -Werror is now added only when DEDX_WERROR is ON.
- ci.yml: all three jobs that build the library from source
  (build_and_test, valgrind, python_tests) now configure with
  -DDEDX_WERROR=ON, so CI keeps full enforcement.
- CMakePresets.json: the sanitize and coverage presets (both CI-only --
  build-sanitize/build-coverage aren't release artifacts) also set
  DEDX_WERROR: ON. debug/release presets are left at the OFF default,
  since those are for local development and don't want to surprise a
  developer on a different compiler version.

Verified locally: -DDEDX_WERROR=ON reproduces the previous behaviour
exactly (compile_commands.json shows -Wall -Wextra -Werror all
present); the default configure (no flag) shows -Wall -Wextra present
but -Werror genuinely absent; both the sanitize and coverage presets
build clean under DEDX_WERROR=ON; full ctest suite (33/33) still green
with -DDEDX_WERROR=ON, matching how CI now configures.