[wangyinz]

Summary

• add pinned Ruff 0.12.8 correctness checks
• build and run the full native CTest suite under Release, ASan, and UBSan
• add a stable aggregate check and strict policy regression tests
• repair the two baseline test defects exposed by the new gates, without changing production behavior

Verification

• independent agent review: PASS
• Ruff exact full-tree command: PASS; baseline exposes 3 F821 errors
• Release, ASan, and UBSan full CTest: 12/12 each
• real ASan UAF/leak and UBSan overflow rejection: PASS
• policy tests, actionlint, strict Sphinx, Black, py_compile, and diff check: PASS

The static-gates required branch-protection context must be added by an administrator only after this workflow is merged and proven on master. Issue #798 remains open until that external step is verified. This PR is not merged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.34%. Comparing base (22b2406) to head (1cce41c).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #947   +/-   ##
=======================================
  Coverage   74.34%   74.34%           
=======================================
  Files         183      183           
  Lines       36506    36506           
  Branches     2540     2540           
=======================================
+ Hits        27140    27141    +1     
+ Misses       8456     8455    -1     
  Partials      910      910           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.