[ColinLeeo]

Summary

Implements #1027.

• Adds a coordinated sanitizer build mode (-Dtsfile.sanitizer=address) that instruments libtsfile and every Cython extension with the same ASan/LSan check set. C++ gets -fsanitize on compile and on the shared-library link with debug info and frame pointers; setup.py builds every extension (including python_random_access_read_file.cc) with -O1 -g -fno-omit-frame-pointer, links the sanitizer runtime, and verifies all artifacts with nm/readelf. Sanitizer builds refuse to produce wheels.
• Fixes a pre-existing CMake issue where the sanitizer compile flags were applied before the bundled third-party build resets CMAKE_CXX_FLAGS and never restored, so TsFile sources were linked against the runtime but not compiled with instrumentation. The bindings mode now re-applies them after third_party; the C++-only ASan mode keeps its historical static-runtime setup to avoid mixing static and dynamic runtimes.
• Fixes ownership leaks surfaced by the new checks: STRING/TEXT result buffers, BLOB (now length-aware, preserving embedded NUL bytes), writer-side schema structs, result-set metadata and schema arrays on error paths, and the C wrapper bad_alloc path. Adds tsfile_free_buffer so bindings release buffers with the allocating module's CRT.
• Adds a Linux CI job with subprocess-based ownership scenarios (tree/table/dataset/Arrow reads, all value types including NULLs, early termination, exception cleanup, repeated open/close, reader/result lifetime, file-object adapter), an import-only baseline, and positive controls. Leak reports are attributed by allocation stack: only leaks reaching TsFile modules fail the run; interpreter/third-party noise is handled with narrow suppressions.
• Documents build/run commands, runtime preloading, symbolization, and the suppression policy in python/SANITIZER.md.

Why

C++ sanitizer jobs did not exercise the bindings, so native ownership defects across the Python -> Cython -> C wrapper -> C++ chain were invisible. All binding leaks fixed here were present before this change.

Testing

• Normal build (macOS): 603 Python tests pass (16 sanitizer tests skipped), 1412 C++ tests pass; normal wheel builds; a sanitizer wheel is refused.
• Linux (Ubuntu 24.04, GCC 13, Python 3.12) with -Dtsfile.sanitizer=address -Dbuild.type=RelWithDebInfo:
  • Maven BUILD SUCCESS; check_sanitizer_build.py reports all six binaries instrumented (compile references plus linked runtime).
  • Ownership suite: 15/15 (13 scenarios and 2 positive controls).
  • Full Python suite under the instrumented build: 619 passed.
  • Temporarily reintroducing the old string-buffer leak makes tree_full fail with tsfile_result_set_get_value_by_index_string in the allocation stack; restoring the fix returns the suite to green.

Reviewer notes

• TSFILE_SANITIZER_SHARED_RUNTIME keeps the sanitizer runtime dynamic in the shared library so one preloaded runtime serves Python, the extensions, and libtsfile. The C++-only ASan jobs do not enable it.
• LD_PRELOAD must list libasan first and libstdc++ second; otherwise GCC's __cxa_throw interceptor aborts the first time a C++ exception is thrown. This is documented and used in CI.
• The sanitizer job runs the new ownership suite; the normal Python matrix still runs the full suite.
• Build-time instrumentation verification requires nm and readelf (binutils), installed in the CI job.

Follow-up

• [C++] ENABLE_ASAN builds do not instrument TsFile sources #1062 — C++-only ASan builds do not instrument TsFile sources (same CMAKE_CXX_FLAGS reset, intentionally out of scope here).

Supersedes #1047 (same content; the source branch was renamed so repository branch names stay descriptive).

[ColinLeeo]

Closing: #1047 was already merged (7b96800) and contains the same commits. No separate PR is needed.