ci: dependency vulnerability scan (cargo-audit) and memory safety check (ASAN)

[membphis]

Motivation

CI currently has no gates for:

1. Supply-chain vulnerabilities — cargo-audit checks Cargo.lock against the RustSec advisory database. A vulnerable transitive dep (e.g. in memchr, once_cell) would be silently shipped.
2. Memory safety errors — The FFI boundary between Rust and LuaJIT is an unsafe surface. AddressSanitizer (ASAN) or Valgrind would catch use-after-free or buffer overruns that safe Rust alone cannot detect (e.g. bugs in pointer arithmetic in src/ffi.rs, or misuse of the FFI from the Lua side).

Proposed work

cargo-audit job

- name: Security audit
  run: |
    cargo install cargo-audit --locked
    cargo audit

Add to ci.yml as a standalone job (fast, ~30s) that runs on every push and PR.

ASAN job (Linux only)

- name: Build and test with ASAN
  env:
    RUSTFLAGS: "-Z sanitizer=address"
  run: |
    cargo +nightly test --release --target x86_64-unknown-linux-gnu

Run a subset of integration tests (the FFI smoke suite) under ASAN nightly. Gate on nightly toolchain only — does not block stable CI.

Tradeoffs

• cargo-audit is fast and has zero false-positive risk; add unconditionally.
• ASAN requires nightly and ~2× slower builds; run as a separate optional job.

Affected files

• .github/workflows/ci.yml