ASAN_OPTIONS=detect_leaks=0 make test-sanitize
GCC 11.4.0; AddressSanitizer + UndefinedBehaviorSanitizer
PASS test-sanitize-guard: 113 checks; no native backend linked, no signals sent
PASS test-sanitize-runtime: 50 checks; all platform calls mocked, no signals sent
LeakSanitizer was intentionally disabled because the supervised environment can reject ptrace; no leak-check result is claimed.