Harden scrape rendering and add AddressSanitizer test suite

Move all heap allocation out of the slab-mutex critical section in
render_prom/render_json: snapshot cardinality under a brief lock,
allocate aggs/snaps/string tables outside the lock, then re-acquire
only to deep-copy strings and walk the LRU into the pre-allocated
buffers. A worker crash during output buffer allocation can no
longer leave the shared-memory zone locked, and a corrupt cardinality
count is caught by a 10k sanity cap rather than causing a runaway
ngx_pcalloc.

Add build-asan and tests/02-asan/: a full sanitizer-instrumented
nginx + module built via apt-source, and a 2-node containerlab
Robot suite that drives reload storms, concurrent scrape-during-reload,
and intern-table growth, failing if AddressSanitizer or UBSan
reports anything on stderr. The two Robot suites now check for
their required build artifacts up front so `make robot-test` no
longer rebuilds them on every invocation.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/01-module/01-e2e.robot

@@ -201,6 +201,7 @@ Request count accuracy
 # --- Lab lifecycle ---
 
 Deploy Lab
+    Require Deb Build
     Run    ${CLAB_BIN} --runtime ${runtime} destroy -t ${CURDIR}/${lab-file} --cleanup 2>&1 || true
     ${rc}    ${output} =    Run And Return Rc And Output
     ...    ${CLAB_BIN} --runtime ${runtime} deploy -t ${CURDIR}/${lab-file}
@@ -210,6 +211,16 @@ Deploy Lab
     Wait Until Keyword Succeeds    60s    3s    Client Can Reach Server    ${CLIENT1}    10.0.1.1
     Wait Until Keyword Succeeds    60s    3s    Client Can Reach Server    ${CLIENT2}    10.0.2.1
 
+Require Deb Build
+    [Documentation]    Fail fast with an actionable message if the user
+    ...                forgot to run `make pkg-deb` before invoking this
+    ...                suite. The server container dpkg-installs the
+    ...                built .deb via its bind-mount of build/.
+    ${rc}    ${output} =    Run And Return Rc And Output
+    ...    bash -c 'ls ${EXECDIR}/build/libnginx-mod-http-ipng-stats_*.deb 2>/dev/null'
+    Run Keyword If    ${rc} != 0
+    ...    Fail    Module .deb not found — run `make pkg-deb` first.
+
 Server Is Ready
     ${rc}    ${output} =    Run And Return Rc And Output
     ...    curl -sf ${SCRAPE_URL}