[P2][CI] Add focused Python static and native sanitizer gates #798

Baseline

Verified on master commit 61b06b965265a1327b84a8c6b6d7de491d9db97e.

Problem

PR CI has no focused Python fatal-error lint and no native ASan/UBSan verification.

Impact

Undefined names/syntax-class defects, undefined behavior and memory misuse reach review without automated signal.

Acceptance criteria

Pin Ruff exactly to 0.12.8 and run exactly E9,F63,F7,F82 over python/mspasspy and python/tests, introducing no waiver, ignore list, or per-file suppression. For every PR changing cxx/** or native C++ tests, configure two native builds—ASan and UBSan—and run the complete native ctest --output-on-failure suite in each; any report or test failure fails the job. Add one stable aggregate check named static-gates that always runs, requires Ruff success and either both sanitizer jobs' success or their path-filtered not-applicable state, and is a required master branch-protection context. Limit this PR to these gates and policy tests.

Required tests

The clean baseline passes Ruff 0.12.8 and both full native sanitizer suites. Temporary controlled E9/F63/F7/F82 fixtures each fail without a suppression; temporary ASan and UBSan violations each fail. Workflow policy tests assert complete ctest execution, path conditions, aggregate failure propagation, and the branch-protection API reports static-gates required.

Related

Formatting is PLAT-BLACK and support matrix is PLAT-SUPPORT-MATRIX.