ci(smoke): sanitizer build + module/interaction/a11y/layout coverage

Turn the smoke test into a real runtime safety net. Waybar is now built with
AddressSanitizer and exercised end to end in a headless compositor:

- Tier 0: run everything under ASan; fail on ASan reports and Gtk/GLib
  criticals in the log (lib.sh assert_clean)
- Tier 1: per-module render matrix (modules.sh) — each headless-safe module
  rendered in isolation
- Tier 2: pointer interaction (interact.sh) — inject clicks via sway, assert
  on-click side effect and format-alt toggle; AT-SPI assertions (a11y.sh/.py)
  check module labels semantically instead of by pixels
- Tier 3: layout matrix (positions.sh) — top/bottom/left + HiDPI scale 2;
  second compositor run under labwc

Shared helpers extracted to lib.sh. Adds a workflow_dispatch `bless` input to
regenerate the golden reference in one click. Trigger push only on master to
avoid duplicate PR runs. AT-SPI and labwc steps are continue-on-error.

test/smoke/positions.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Tier 3 — layout matrix: bar at top/bottom (horizontal) and left (vertical),
+# plus a HiDPI (scale 2) run. Each must launch and render without a crash or
+# sanitizer/critical error. Screenshots are uploaded for visual inspection.
+#
+# Usage: positions.sh [screenshot-dir]
+set -euo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib.sh
+source "$DIR/lib.sh"
+
+SHOTDIR="${1:-layout-shots}"
+mkdir -p "$SHOTDIR"
+
+smoke::setup
+trap smoke::stop EXIT
+
+fails=()
+
+# run_case <name> <position> <scale>
+run_case() {
+    local name="$1" pos="$2" scale="$3"
+    echo "::group::layout: $name (position=$pos scale=$scale)"
+    SCALE="$scale" smoke::start_compositor || { fails+=("$name"); echo "::endgroup::"; return; }
+    local cfg; cfg="$(mktemp --suffix=.json)"
+    cat > "$cfg" <<EOF
+{
+  "layer": "top", "position": "$pos", "height": 30,
+  "modules-left": ["custom/l"], "modules-center": ["custom/c"], "modules-right": ["custom/r"],
+  "custom/l": { "exec": "echo LEFT",   "interval": "once" },
+  "custom/c": { "exec": "echo CENTER", "interval": "once" },
+  "custom/r": { "exec": "echo RIGHT",  "interval": "once" }
+}
+EOF
+    smoke::launch_waybar "$cfg" "$DIR/style.css" 4
+    local ok=1
+    smoke::assert_alive || ok=0
+    smoke::assert_clean || ok=0
+    smoke::screenshot "$SHOTDIR/$name.png" || true
+    [ "$ok" = 1 ] || fails+=("$name")
+    smoke::stop
+    echo "::endgroup::"
+}
+
+run_case top-x1    top    1
+run_case bottom-x1 bottom 1
+run_case left-x1   left   1
+run_case top-x2    top    2
+
+if [ "${#fails[@]}" -gt 0 ]; then
+    echo "::error::layout cases failed: ${fails[*]}"
+    exit 1
+fi
+echo "✓ all layout cases launched and rendered cleanly"