[CI] Split the sanitizer leg from the Ubuntu packaging leg (#7666)

The sanitize leg re-ran the Release packaging build after the instrumented
one, so 18 minutes of Release compile queued behind the sanitizer run in a
single job. Give sanitize its own leg with its own image and ccache, and
keep the plain Ubuntu leg publishing the DEB.

- The coverage leg's packaging comment now points at the leg that actually
  publishes the DEB.
- The -DENABLE_SANITIZERS=OFF comment no longer describes a debug-sanitize
  then release-package sequence that no job runs.

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

.ci/compile.sh

@@ -175,9 +175,9 @@ fi
 if [[ $MAKE_SANITIZE ]]; then
   flags+=("-DENABLE_SANITIZERS=ON")
 else
-  # The release-package step re-runs cmake in the same build dir, so an
-  # ENABLE_SANITIZERS=ON left over from the debug step would otherwise leak
-  # into the shipped binaries (libasan/libubsan Depends in the DEB).
+  # Every leg states the flag explicitly rather than relying on the CMake
+  # default, so a build directory reused from a sanitized configuration can
+  # never leak libasan/libubsan into a shipped binary.
   flags+=("-DENABLE_SANITIZERS=OFF")
 fi
 if [[ $MAKE_COVERAGE ]]; then

.github/workflows/desktop-build.yml

@@ -187,10 +187,21 @@ jobs:
             version: 26.04
 
             package: DEB
+            test: skip    # The sanitizer leg below runs this distro's suite
 
-            # The one leg that runs the suite under AddressSanitizer and
-            # UndefinedBehaviorSanitizer. Debian 13 and Fedora 44 keep covering the
-            # uninstrumented suite, so nothing is lost by instrumenting this one.
+          # The one leg that runs the suite under AddressSanitizer and
+          # UndefinedBehaviorSanitizer. Debian 13 and Fedora 44 keep covering the
+          # uninstrumented suite, so nothing is lost by instrumenting this one.
+          #
+          # It packages nothing. A sanitized Debug build is not something to ship, and
+          # carrying the package build here meant 18 minutes of Release compile queued
+          # behind the instrumented one in a single job. The leg above publishes this
+          # distro's DEB.
+          - distro: Ubuntu
+            version: 26.04
+            variant: sanitize    # separate image and ccache, same distro
+
+            package: skip
             sanitize: yes
 
           - distro: Ubuntu
@@ -202,7 +213,7 @@ jobs:
             # sanitizer leg because the two instruments answer different questions: the
             # sanitizer leg reports what the run did wrong, the coverage leg reports what the
             # run never touched at all. Combining them would also slow both down. Packaging is
-            # skipped because the leg above already publishes the DEB for this distro.
+            # skipped because the plain Ubuntu 26.04 leg publishes the DEB for this distro.
             coverage: yes
             package: skip