Test/tooling only — no source or API change.
- Adds a cmark safety harness: multibyte/byte-position correctness, memory-safety (UAF/iterator/re-parse churn), leak/retain-cycle, and concurrency tests (62 → 98 tests).
- CI now runs the suite under Address and Thread sanitizers.
- No latent memory/leak/concurrency/multibyte-position issues found; the position mapping was already byte-correct (old tests were ASCII-only).
Prerequisite safety net for a future CMNode wrapper-allocation optimization. (#9)