Build: link public C API hosts with the TSan runtime

Problem

Running zig build test-c-api -Dtsan=true instruments libzig-js.a, but the four public C/C++ host executables are built without sanitize_thread = tsan. Their links fail before execution with unresolved __tsan_* symbols.

This was exposed while validating #871. The inspector implementation itself passes the 24-test inspector group under TSan, and both pinned private inspector-agent fixtures pass under TSan; the failure is isolated to the public host build wiring.

Affected hosts:

• c-api-smoke-c
• c-api-latin1
• c-api-smoke-cpp
• c-api-inspector-smoke

Required implementation

• Propagate the existing tsan build option into every public C/C++ host root module.
• Keep the library and host instrumentation/link mode consistent without manual linker flags or environment workarounds.
• Verify the complete test-c-api step in Debug, ReleaseSafe, and TSan modes.
• Preserve the pinned public ABI and generated headers unchanged.

Acceptance

• zig build test-c-api passes.
• zig build test-c-api -Doptimize=ReleaseSafe passes.
• zig build test-c-api -Dtsan=true links and passes with no sanitizer reports.
• zig build c-api-audit remains 117/117 complete.
• Change flips 0 test262 cases.

Related: #493, #495, #871.

Confirmed while closing #871: the 24-test inspector group passes under TSan and both pinned private inspector-agent fixtures pass under TSan. The remaining failure is specifically the public test-c-api host link: the static library contains TSan instrumentation while the four host root modules omit the sanitizer setting/runtime.

Fixed and pushed to main in 99e534be.

The existing tsan option now configures all four public C/C++ host root modules, so the host links pull in the same sanitizer runtime required by the instrumented libzig-js.a.

Evidence:

• zig build test-c-api: pass.
• zig build test-c-api -Doptimize=ReleaseSafe: pass.
• zig build test-c-api -Dtsan=true: links and passes with no sanitizer reports.
• c-api-audit: 117/117 complete, 26 zig-js extensions, 460 private profile exports.
• Public headers and ABI inventory unchanged.
• test262 not run because the change is limited to native fixture build wiring.