ci: drop sanitizers job; harden test_subagent fake server

test_subagent segfaulted in the Docker runner: the fake SSE handler took
user + strlen(user) - 1 with an empty user string. Guard JSON access and
format the child report with an empty-safe last character. Remove the
sanitizers job entirely (if: false still queued it and blocked the runner).

.gitea/workflows/ci.yml

@@ -49,37 +49,6 @@ jobs:
           ./cst-agent --workspace "$PWD" --list-sessions
           ./cst-agent --demo-ctl --workspace .
 
-  # Disabled: Docker runner lacks SYS_PTRACE; ASan spins on DEADLYSIGNAL and
-  # wedged the only runner. Re-enable after the runner gets --cap-add SYS_PTRACE
-  # (or seccomp=unconfined).
-  sanitizers:
-    if: false
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Checkout
-        env:
-          GITHUB_SERVER_URL: ${{ github.server_url }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-          GITHUB_SHA: ${{ github.sha }}
-        run: |
-          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
-            -o /tmp/ci_checkout.sh
-          bash /tmp/ci_checkout.sh
-      - name: Install dependencies
-        run: |
-          SUDO=$(command -v sudo || true)
-          $SUDO bash scripts/ci_pkg_mirror.sh
-          $SUDO apt-get update
-          $SUDO apt-get install -y --no-install-recommends \
-            build-essential pkg-config libcurl4-openssl-dev libncurses-dev
-      - name: ASan + UBSan
-        timeout-minutes: 10
-        env:
-          ASAN_OPTIONS: abort_on_error=1:halt_on_error=1:detect_leaks=0:use_sigaltstack=0
-          UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
-        run: timeout -s KILL 480 make asan
-
   musl:
     runs-on: ubuntu-latest
     timeout-minutes: 30