[CI] Run the suite once under ASan and UBSan

Adds --sanitize to .ci/compile.sh, mirroring --test, and turns it on for one entry of
the existing Linux Docker matrix: Ubuntu 26.04, which already had a test-enabled leg.
That reuses the image, the ccache layer and the existing step shape, so the CI diff is a
matrix key plus the argument plumbing. Debian 13 and Fedora 44 keep covering the
uninstrumented suite, so nothing is lost by instrumenting one leg.

Sanitizers stay off the release and package legs, which build with --release for
packaging: instrumenting those would change the shipped binaries' optimization profile
and build time for no benefit. macOS and Windows stay uninstrumented too, since ASan is
unreliable against the Qt build there and MSVC has no equivalent without /fsanitize=address.

--sanitize does not imply --test, so an instrumented build can be produced locally
without paying for ctest. When both are given, ctest runs with detect_leaks=0 because Qt
and the sanitizer runtimes both leak at exit by design and LeakSanitizer's default buries
real findings under hundreds of process-teardown reports, and with UBSan halt_on_error=0 so
one run collects many findings instead of stopping at the first. ASan keeps
abort_on_error=1, since a bad access leaves the process unusable and continuing only
produces a second, more confusing report from the wreckage.

.github/workflows/desktop-build.yml

@@ -144,6 +144,11 @@ jobs:
 
             package: DEB
 
+            # The one leg that runs the suite under AddressSanitizer and
+            # UndefinedBehaviorSanitizer. Debian 13 and Fedora 44 keep covering the
+            # uninstrumented suite, so nothing is lost by instrumenting this one.
+            sanitize: yes
+
     name: ${{ matrix.distro }} ${{ matrix.version }}
     needs: configure
     runs-on: ubuntu-latest    # https://github.com/actions/runner-images
@@ -174,6 +179,8 @@ jobs:
       - name: "Build debug and test"
         if: matrix.test != 'skip'
         shell: bash
+        env:
+          sanitize: '${{ matrix.sanitize }}'
         run: |
           source .ci/docker.sh
           args=()
@@ -181,7 +188,10 @@ jobs:
           args+=(--ccache "$CCACHE_SIZE")
           args+=(--cmake-generator "$CMAKE_GENERATOR")
 
-          RUN --server --debug --test "${args[@]}"
+          extra=()
+          [[ $sanitize == yes ]] && extra+=(--sanitize)
+
+          RUN --server --debug --test "${extra[@]}" "${args[@]}"
 
       - name: "Build release package"
         id: build