ci(smoke): sanitizer build + module/interaction/a11y/layout coverage

Turn the smoke test into a real runtime safety net. Waybar is now built with
AddressSanitizer and exercised end to end in a headless compositor:

- Tier 0: run everything under ASan; fail on ASan reports and Gtk/GLib
  criticals in the log (lib.sh assert_clean)
- Tier 1: per-module render matrix (modules.sh) — each headless-safe module
  rendered in isolation
- Tier 2: pointer interaction (interact.sh) — inject clicks via sway, assert
  on-click side effect and format-alt toggle; AT-SPI assertions (a11y.sh/.py)
  check module labels semantically instead of by pixels
- Tier 3: layout matrix (positions.sh) — top/bottom/left + HiDPI scale 2;
  second compositor run under labwc

Shared helpers extracted to lib.sh. Adds a workflow_dispatch `bless` input to
regenerate the golden reference in one click. Trigger push only on master to
avoid duplicate PR runs. AT-SPI and labwc steps are continue-on-error.

test/smoke/run.sh

@@ -1,77 +1,22 @@
 #!/usr/bin/env bash
-# Launch Waybar inside a headless sway compositor and verify it starts and
-# renders. Used by the `smoke` CI workflow.
+# Launch Waybar inside a headless compositor and verify it starts, stays alive,
+# logs no sanitizer/critical error, and (optionally) renders a screenshot.
 #
 # Usage: run.sh <config> [style] [screenshot.png]
-#   - always: assert waybar launches, stays alive, logs no fatal error
-#   - if <screenshot.png> given: capture the bar with grim
-#
-# Requires: sway, grim, waybar (on PATH). Software-rendered, no GPU needed.
 set -euo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib.sh
+source "$DIR/lib.sh"
 
-CONFIG="$1"
-STYLE="${2:-}"
-SHOT="${3:-}"
+CONFIG="$1"; STYLE="${2:-}"; SHOT="${3:-}"
 
-export XDG_RUNTIME_DIR="$(mktemp -d)"
-chmod 700 "$XDG_RUNTIME_DIR"
-export WLR_BACKENDS=headless
-export WLR_RENDERER=pixman
-export WLR_LIBINPUT_NO_DEVICES=1
-export LIBGL_ALWAYS_SOFTWARE=1
+smoke::setup
+smoke::start_compositor
+trap smoke::stop EXIT
+smoke::launch_waybar "$CONFIG" "$STYLE"
 
-LOG="$(mktemp)"
-SWAYCFG="$(mktemp)"
+echo "::group::waybar log"; smoke::log; echo "::endgroup::"
 
-wb="waybar -c $CONFIG"
-[ -n "$STYLE" ] && wb="$wb -s $STYLE"
-
-cat > "$SWAYCFG" <<EOF
-output HEADLESS-1 resolution 1920x1080 background #000000 solid_color
-exec "$wb -l debug > $LOG 2>&1"
-EOF
-
-echo "::group::Starting sway (headless) + waybar"
-sway -c "$SWAYCFG" &
-SWAY_PID=$!
-
-cleanup() {
-    swaymsg -q exit 2>/dev/null || kill "$SWAY_PID" 2>/dev/null || true
-}
-trap cleanup EXIT
-
-# Wait for the Wayland socket to appear.
-sock=""
-for _ in $(seq 1 40); do
-    sock="$(find "$XDG_RUNTIME_DIR" -maxdepth 1 -name 'wayland-*' ! -name '*.lock' 2>/dev/null | head -1 || true)"
-    [ -n "$sock" ] && break
-    sleep 0.5
-done
-[ -n "$sock" ] || { echo "::error::compositor did not create a Wayland socket"; exit 1; }
-export WAYLAND_DISPLAY="$(basename "$sock")"
-echo "compositor up on WAYLAND_DISPLAY=$WAYLAND_DISPLAY"
-echo "::endgroup::"
-
-# Give modules time to poll/settle.
-sleep 6
-
-echo "::group::Waybar log"
-cat "$LOG" || true
-echo "::endgroup::"
-
-# --- Level 1: smoke ---
-if ! pgrep -x waybar >/dev/null; then
-    echo "::error::waybar is not running — it crashed on startup (config: $CONFIG)"
-    exit 1
-fi
-if grep -iqE 'critical|segfault|\bfatal\b|terminate called' "$LOG"; then
-    echo "::error::waybar logged a fatal error (config: $CONFIG)"
-    exit 1
-fi
-echo "✓ waybar launched and stayed alive under headless sway"
-
-# --- Level 2: screenshot ---
-if [ -n "$SHOT" ]; then
-    grim "$SHOT"
-    echo "✓ captured screenshot -> $SHOT"
-fi
+smoke::assert_alive
+smoke::assert_clean
+[ -n "$SHOT" ] && smoke::screenshot "$SHOT"