chore: CI: enable leak sanitizer again (#11339)

.github/workflows/build-template.yml

@@ -46,8 +46,6 @@ jobs:
       CCACHE_MAXSIZE: 400M
       # squelch error message about missing nixpkgs channel
       NIX_BUILD_SHELL: bash
-      # TODO
-      ASAN_OPTIONS: detect_leaks=0
       LSAN_OPTIONS: max_leaks=10
       # somehow MinGW clang64 (or cmake?) defaults to `g++` even though it doesn't exist
       CXX: c++

.github/workflows/ci.yml

@@ -153,7 +153,7 @@ jobs:
       # 0: PRs without special label
       # 1: PRs with `merge-ci` label, merge queue checks, master commits
       # 2: nightlies
-      # 2: PRs with `release-ci` label, full releases
+      # 3: PRs with `release-ci` label, full releases
       - name: Set check level
         id: set-level
         # We do not use github.event.pull_request.labels.*.name here because
@@ -259,15 +259,15 @@ jobs:
               },
               {
                 "name": "Linux fsanitize",
-                "os": "ubuntu-latest",
+                // Always run on large if available, more reliable regarding timeouts
+                "os": large ? "nscloud-ubuntu-22.04-amd64-8x16-with-cache" : "ubuntu-latest",
                 "enabled": level >= 2,
-                // do not have nightly release wait for this
-                "secondary": level <= 2,
                 "test": true,
                 // turn off custom allocator & symbolic functions to make LSAN do its magic
                 "CMAKE_PRESET": "sanitize",
-                // exclude seriously slow/problematic tests (laketests crash, async_base_functions timeouts)
-                "CTEST_OPTIONS": "-E '(interactive|pkg|lake|bench)/|treemap|StackOverflow|async_base_functions'"
+                // `StackOverflow*` correctly triggers ubsan
+                // `reverse-ffi` fails to link in sanitizers
+                "CTEST_OPTIONS": "-E 'StackOverflow|reverse-ffi'"
               },
               {
                 "name": "macOS",