CI hygiene: pin numsim-cas, enable -Werror on tests, add UBSan/ASan job

[petlenz]

Summary

Three related CI gaps:

1. `numsim-cas` pinned to a moving branch

`CMakeLists.txt:43` sets `GIT_TAG main` for the `FetchContent` of `numsim-cas`. A breaking change upstream will flip CI red without any commit here, and an old green build is unreproducible.

Fix: pin to the current `numsim-cas` HEAD SHA. Bump deliberately when needed.

2. No -Werror / no warning flags on tests

`numsim_codegen` is an INTERFACE target so it can't carry compile options directly, but the test target can:

target_compile_options(numsim_codegen_tests PRIVATE -Wall -Wextra -Wpedantic -Werror)

This locks down the generator, driver, and all unit tests.

3. No sanitizer matrix entry

A clang+Debug job with `-fsanitize=address,undefined -fno-sanitize-recover=all` would catch:

• Any future ownership bug across `expression_holder` references stored in `m_scalar_symbols` / `m_tensor_symbols`.
• The MOOSE-adaptor dim bug (MOOSE adaptor ignores tensor dim — silent miscompute when dim != 3 #7) if dim is mis-sized in any future test.
• Unsigned overflow / null-deref in the visitor chain.

Add a matrix entry in `.github/workflows/build.yml`.

Where

• `CMakeLists.txt:40-46`
• `.github/workflows/build.yml`
• `tests/CMakeLists.txt`

Refs

• REVIEW.md → CI-A1 (High), CORR-17, CORR-18, CORR-19, CORR-20
• Severity: High

[petlenz]

The "pin `numsim-cas`" piece of this issue now has a dedicated implementation issue: #21 (migrate from raw `FetchContent` to CPM.cmake). CPM gives us pinning + caching + a clean local-checkout path in one move.

The other two pieces of this issue (warnings-as-errors on tests, UBSan/ASan job) remain in scope here — they're independent of dep management.

[petlenz]

Tracked as a cross-cutting concern of the NumSim compiler epic #28. The epic extends this issue's scope by adding macOS clang and at least one HPC compiler (Intel ICX / NVHPC) to the CI matrix — MOOSE deployment targets that today's ubuntu-24.04-only matrix can't validate. The warnings-as-errors + sanitizer pieces remain primarily scoped here.

[petlenz]

Cross-link: the -Werror-on-tests part of this issue is now done in #89 (first-party -Wall -Wextra -Werror gated to Debug + a CI Debug gate on gcc-14/clang-19; merged in #88). The remaining items here — pin numsim-cas (done: CMake pins an explicit SHA, bumped in #87) and the UBSan/ASan job (still open) — are what's left of this issue. Suggest narrowing it to the sanitizer job.

[petlenz]

Status check from the 2026-08-02 full-repo review: two of three items here are done (numsim-cas SHA-pinned in CMakeLists.txt; tests build with the warnings target + Debug -Werror). The UBSan/ASan job remains open — and it's now free to add: the full suite passes ASan+UBSan clean locally (gcc-14 Debug, -fsanitize=address,undefined -fno-sanitize-recover=all, 321/321 tests in ~11 s wall). One matrix leg, starts green, and it's the right guard for the pointer-keyed CSE (CodeGenContext) lifetime class the tests currently work around by hand (see SpectralCodeEmitTest.cpp:115-119). Workflow-security hardening (permissions/action pinning/concurrency) filed separately as #141.