Verify #1783's fix in CI: [0ff]/[0fk] sanitizer variants in an ASan shard, and #1725's P1 red there #1789

Follow-up of #1783, whose fix lands with #1776 (commit d8076836 on phase2-numbers, "Closes #1783"). The fix was verified on the 4 GB dev box only, so the two CI items of #1783's checklist would close unverified at merge.

What was verified locally (2026-10-15)

tests/suite_variant.sh is the one shared predicate. It finds the build/<variant>/eigenscript the suite binary is hard-linked to, then asks the Makefile (make print-FLAGS_<variant>) whether that variant builds with ASan.

• ASan suite (make asan): [0ff] printed test binary variant: asan and [0fk] printed slot test variant: asan.
• make asan-server, with EIGS_SUITE_SECTIONS='0ff 0fk': [0ff] printed test binary variant: asan-server and built build/asan-server/test_container_slots; [0fk] printed slot test variant: asan. Result: RESULTS: 2/2 passed.
• Leak gating misses a container-store leak outside [0ff]: [69] Leak Guard and [106] stay green #1725's P1 planted (list_set_slot_owned never calls slot_decref(old)), asan-server, [0ff] only:
  • with the old build/asan-only detection: Container slot API test built: build/release/test_container_slots, RESULTS: 1/1 passed (the leak was invisible);
  • with the shared predicate: ERROR: LeakSanitizer: detected memory leaks, RESULTS: 0/1 passed, 1 failed.

Done when

• A CI ASan shard log (the asan + ubsan / shard k/3 (http+model build) jobs) on a head containing d8076836 shows test binary variant: asan-server and Container slot API test built: build/asan-server/test_container_slots for [0ff], and slot test variant: asan for [0fk]. Paste the job URL and the lines.
• A dispatched CI ASan run with Leak gating misses a container-store leak outside [0ff]: [69] Leak Guard and [106] stay green #1725's P1 planted turns [0ff] red with a LeakSanitizer report. Paste the job URL.