CI: propagate TSan to private ABI consumer fixtures

Parent: #140

Private ABI fixtures could previously link a TSan-instrumented zig-js library from an unsanitized executable root, producing unresolved sanitizer symbols instead of running the fixture. The build now propagates -Dtsan=true to every applicable private ABI executable and a bounded audit prevents drift.

Acceptance

• Audit every private ABI executable that can link a TSan-instrumented zig-js library.
• Propagate the build's tsan option to every applicable executable root module.
• Keep non-TSan Debug/ReleaseSafe artifacts unchanged.
• Run the complete Home private 392-symbol runtime fixture under TSan without linker or sanitizer failures.
• Add a bounded CI regression gate.
• Document the gate concisely and reconcile exact main CI.

Completed by fff17a8a; exact-main run 29806223245 passed 43/43 jobs.

Implemented and pushed in fff17a8a.

Evidence:

• build audit: 36/36 Home/Bun private consumer executables propagate -Dtsan
• full Home private fixture under TSan: 392/392 linked and passed with no sanitizer report
• the bounded audit and one full TSan command now run in the existing private-ABI CI leg
• Debug/ReleaseSafe behavior remains selected by the existing shared build option

Exact descendant main reconciliation is run 29806223245; closure waits for that unsuperseded run.

Closed against exact main commit e3fdc52385204c75fe6ae5c64d48dae6e5ede418: Actions run 29806223245 completed successfully with all 43 jobs terminal and no failures.