ci(smoke): sanitizer build + module/interaction/a11y/layout coverage

Turn the smoke test into a real runtime safety net. Waybar is now built with
AddressSanitizer and exercised end to end in a headless compositor:

- Tier 0: run everything under ASan; fail on ASan reports and Gtk/GLib
  criticals in the log (lib.sh assert_clean)
- Tier 1: per-module render matrix (modules.sh) — each headless-safe module
  rendered in isolation
- Tier 2: pointer interaction (interact.sh) — inject clicks via sway, assert
  on-click side effect and format-alt toggle; AT-SPI assertions (a11y.sh/.py)
  check module labels semantically instead of by pixels
- Tier 3: layout matrix (positions.sh) — top/bottom/left + HiDPI scale 2;
  second compositor run under labwc

Shared helpers extracted to lib.sh. Adds a workflow_dispatch `bless` input to
regenerate the golden reference in one click. Trigger push only on master to
avoid duplicate PR runs. AT-SPI and labwc steps are continue-on-error.

test/smoke/modules.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Tier 1 — per-module matrix: render each headless-safe module in isolation and
+# assert it loads, logs no sanitizer/critical error, and draws something.
+#
+# Usage: modules.sh <screenshot-dir>
+set -euo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib.sh
+source "$DIR/lib.sh"
+
+SHOTDIR="${1:-module-shots}"
+mkdir -p "$SHOTDIR"
+
+# module name -> its config options (JSON object). Only modules that work with
+# no real hardware/daemon in a headless runner are included.
+declare -A MODULES=(
+    [clock]='{}'
+    [cpu]='{}'
+    [memory]='{}'
+    [disk]='{}'
+    [idle_inhibitor]='{"format":"{status}"}'
+    [custom/echo]='{"exec":"echo hello","interval":"once"}'
+)
+
+smoke::setup
+smoke::start_compositor
+trap smoke::stop EXIT
+
+fails=()
+for mod in "${!MODULES[@]}"; do
+    safe="${mod//\//-}"
+    cfg="$(mktemp --suffix=.json)"
+    cat > "$cfg" <<EOF
+{
+  "layer": "top", "position": "top", "height": 30,
+  "modules-center": ["$mod"],
+  "$mod": ${MODULES[$mod]}
+}
+EOF
+    echo "::group::module: $mod"
+    smoke::launch_waybar "$cfg" "$DIR/style.css" 4
+    ok=1
+    smoke::assert_alive || ok=0
+    smoke::assert_clean || ok=0
+    if [ "$ok" = 1 ]; then
+        smoke::screenshot "$SHOTDIR/$safe.png"
+        smoke::assert_not_blank "$SHOTDIR/$safe.png" || ok=0
+    fi
+    [ "$ok" = 1 ] || fails+=("$mod")
+    kill "$WAYBAR_PID" 2>/dev/null || true
+    sleep 1
+    echo "::endgroup::"
+done
+
+if [ "${#fails[@]}" -gt 0 ]; then
+    echo "::error::modules failed to render cleanly: ${fails[*]}"
+    exit 1
+fi
+echo "✓ all ${#MODULES[@]} modules rendered cleanly"