ci(smoke): sanitizer build + module/interaction/a11y/layout coverage

Turn the smoke test into a real runtime safety net. Waybar is now built with
AddressSanitizer and exercised end to end in a headless compositor:

- Tier 0: run everything under ASan; fail on ASan reports and Gtk/GLib
  criticals in the log (lib.sh assert_clean)
- Tier 1: per-module render matrix (modules.sh) — each headless-safe module
  rendered in isolation
- Tier 2: pointer interaction (interact.sh) — inject clicks via sway, assert
  on-click side effect and format-alt toggle; AT-SPI assertions (a11y.sh/.py)
  check module labels semantically instead of by pixels
- Tier 3: layout matrix (positions.sh) — top/bottom/left + HiDPI scale 2;
  second compositor run under labwc

Shared helpers extracted to lib.sh. Adds a workflow_dispatch `bless` input to
regenerate the golden reference in one click. Trigger push only on master to
avoid duplicate PR runs. AT-SPI and labwc steps are continue-on-error.

test/smoke/a11y.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Tier 2 — accessibility assertions. Must run under a D-Bus session so the
+# AT-SPI bus is available, e.g.:  dbus-run-session -- test/smoke/a11y.sh
+set -euo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib.sh
+source "$DIR/lib.sh"
+
+# Make sure GTK registers with the AT-SPI bridge.
+unset NO_AT_BRIDGE
+export GTK_A11Y=1
+
+smoke::setup
+smoke::start_compositor
+trap smoke::stop EXIT
+smoke::launch_waybar "$DIR/config.jsonc" "$DIR/style.css" 6
+smoke::assert_alive
+python3 "$DIR/a11y.py"