test(runtime): wire real ASAN execution for Bun corpus crash regressions

Tracked from #66.\n\nThe expectation manifest still carries 14 CRASH entries from exact copied Bun ASAN regression fixtures and 13 ASAN-related SKIP entries. Those markers are currently honest: Home's corpus ASAN mode is disabled or inert, so deleting them would report coverage that the runtime does not actually provide.\n\nRequired work:\n- Add an authoritative sanitizer-enabled compiler/runtime lane for the copied Bun corpus.\n- Ensure sanitizer flags reach every native object and linked test executable rather than only the harness process.\n- Execute the original ASAN fixtures with their required environment and timeout behavior.\n- Distinguish a sanitizer finding, an ordinary assertion failure, a signal/crash, and an infrastructure/configuration failure.\n- Preserve diagnostics and reproducible commands in CI artifacts.\n- Convert CRASH/SKIP markers incrementally only when each unchanged fixture truly executes under instrumentation.\n- Add a guard proving the ASAN lane is active, so an inert configuration cannot silently pass.\n\nAcceptance:\n- A deliberate memory-safety canary is detected by the lane.\n- Each promoted upstream fixture runs unchanged and passes under real instrumentation.\n- The corresponding expectation is removed in the same verified commit.\n- The normal non-ASAN suite remains green.

Read-only substrate audit complete. Home currently has no active ASAN lane: -Dsanitize-address=true only publishes metadata, Environment and the JS harness hardcode ASAN false, the safety wrapper is a documented no-op, Home's C++ bridges are not instrumented, release Bun/WebKit objects are selected, and CI has no sanitizer job. The shared-runtime corpus gate also cannot classify a fatal sanitizer abort per fixture.\n\nInventory is broader than the initial 27 visible CRASH/SKIP entries:\n- 14 CRASH fixtures\n- 13 SKIP entries/prefixes\n- 5 TIMEOUT entries\n- 7 LEAK entries\n- 39 ASAN expectations total\n\nActivation gate:\n- [ ] sanitizer mode fails closed without matching pinned Bun release-asan objects, ASAN WebKit, compiler-rt, and platform runtime/rpath\n- [ ] Home's four C++ bridges compile with address instrumentation and LTO stays off\n- [ ] Environment.enable_asan, home_rt.asan.enabled, and harness isASAN agree\n- [ ] upstream ASAN options/JSC assertion profile are restored consistently\n- [ ] a subprocess heap-UAF canary emits a symbolized AddressSanitizer report\n- [ ] a poison/unpoison wrapper canary proves explicit annotations reach instrumentation\n- [ ] corpus fixtures run one process per file/prefix expansion with distinct report/assertion/signal/infrastructure classification\n- [ ] 14 CRASH and 13 SKIP debts are promoted only after clean exact instrumented runs\n- [ ] TIMEOUT and LEAK move through separate timeout/LSAN stages\n- [ ] nightly/manual CI uploads only compressed reports, stdout/stderr, summary, and toolchain manifest\n- [ ] final invariant is 0 ASAN expectations, reports, unexpected exits, and timeouts\n\nNo marker should be removed for a normal logical pass; the activation canary must prove instrumentation first.