feat(engine): UBSan sanitizer baseline + first UB fix (E1)

[dnplkndll]

What changed

Adds the UndefinedBehaviorSanitizer half of Engine track E1 (ASan was already wired and blocking in engine-asan.yml; the golden suite is ASan-clean). Establishes a documented UBSan baseline over the golden test suite and fixes the one genuine UB bug it surfaced.

Sanitizer wiring

• CMakeLists.txt — the Debug build's sanitizer is now selectable via -DFREPPLE_SANITIZER (address default = the unchanged ASan gate, undefined = UBSan, address,undefined = both). Sanitizer flags added to the Debug link line for the shared lib.
• The UBSan build excludes -fsanitize=vptr: frePPLe's object model uses a hand-rolled MetaClass RTTI (downcast by type tag, not C++ polymorphism), which is fundamentally incompatible with the vptr check — it would flood every run with by-design "wrong dynamic type" reports and bury real findings.

CI

• .github/workflows/engine-ubsan.yml — an advisory gate (halt_on_error=0): builds Debug+UBSan, runs the golden suite with runtest.py -d (so the sanitizer reports are visible, not swallowed by the test runner's pipe), and summarises distinct findings in the job step-summary. It fails on a genuine non-UB test break (pipefail) or a UBSan build/link regression, but not on the documented baseline findings. Flips to blocking in E2 once the iterator idiom is retired — the same way engine-asan.yml started informational and became blocking after its crashes were fixed.

The one real fix

• src/model/operationdependency.cpp — set{Operation,BlockedBy} each called addDependency() on a possibly-null receiver (:99, :122, symmetric). UBSan caught :122; :99 is its unexercised mirror. Behaviour-preserving fix (guard the call): Operation::addDependency already early-returns on an incomplete dependency before touching the receiver's members, so guarding is identical in effect — golden output unchanged (verified by the blocking ASan/ubuntu24 suites).

Findings doc

• tools/modernization/ubsan-baseline.md — full root-cause + severity for all three categories and the path to a blocking gate.

Baseline result

96 pure-engine (type-2) golden tests under UBSan. After excluding vptr (Finding 1, by-design) and fixing operationdependency (Finding 3, real/medium), the only remaining diagnostics are the two accepted iterator operator* null-bindings (timeline.h:293, model.h:8667) — UB by the letter, but the same pattern the standard library has for *v.end(), never actually dereferenced. Documented as low/accepted.

Finding	Class	Severity	Disposition
vptr on MetaClass RTTI	by-design false positive	noise	-fno-sanitize=vptr (excluded)
iterator operator* null-binding	UB idiom (STL-parallel)	low	accepted; gate advisory; retire in E2
operationdependency null member-call	real latent UB	medium	fixed (:99, :122)

Verification

• Local Debug+UBSan build (g++, ubuntu:24.04) compiles + links with vptr excluded; re-run confirms 0 vptr and 0 operationdependency findings remain, only the two documented idioms.
• operation_dependency golden test runs clean (no abort) post-fix.
• The blocking engine-asan + ubuntu24 suites (output comparison) are the safety net for the operationdependency behaviour-preservation claim.