[0ff] and [0fk] pick their ASan variant only for build/asan; the CI ASan shards build asan-server, so both run as release there #1783

Found by the #1758 R1.1 blind critic (PR #1776), 2026-10-14.

tests/sections/0ff-container-slots-1665.sh:4, and its copy in #1776 (tests/sections/0fk-phase2-slot-layer.sh:8), choose the sanitizer variant only when the suite binary is ../build/asan/eigenscript:

if [ -e ../build/asan/eigenscript ] && [ ./eigenscript -ef ../build/asan/eigenscript ]; then

The CI ASan shards build make asan-server (ci.yml, "Build with AddressSanitizer + UBSan"), so the suite binary there is build/asan-server/eigenscript. Both sections then run their release variant: no ASan, no LSan, no UBSan.

Observed in merge-queue run 38652383231, job 116154180640 (shard 3/3), section [0ff]:

Container slot API test built: build/release/test_container_slots

Consequences:

• Leak gating misses a container-store leak outside [0ff]: [69] Leak Guard and [106] stay green #1725's "direct catch" (the LSan check in [0ff]'s test_container_slots) never runs in CI. It ran only in a local make asan suite.
• Phase 2 numbers: exact int64 and IEEE doubles (#1758) #1776's [0fk] (the Decision: an exact int64 value kind and IEEE-faithful doubles (#1644 phase 2), with the observer signal (#1667) in the same tape bump #1758 C slot test) never runs its ASan/UBSan variant in CI, although design 2.5 says each entry is called under ASan. In the ASan shard it compiles the release-flavour amalgamation at -O2 instead, which costs about a minute of the shard.

Done when

• [0ff] and [0fk] select the sanitizer variant whenever the suite binary is a sanitizer build (asan or asan-server), through one shared predicate.
• A CI ASan shard log shows the sanitizer test binary (not build/release/...) for both sections.
• Planted: Leak gating misses a container-store leak outside [0ff]: [69] Leak Guard and [106] stay green #1725's P1 (list_set_slot_owned skips slot_decref(old)) turns [0ff] red in a CI ASan shard.