Re-enable AddressSanitizer on aarch64 via native arm64 runners

[aflores-qb]

Closes #311.

Root cause

The aarch64 images are cross-built and then run (docker run test step) under QEMU-user emulation. AddressSanitizer aborts at startup there:

CHECK failed: sanitizer_allocator_primary64.h:131 "((kSpaceBeg)) == ((address_range.Init(...)))" (0x500000000000, 0xfffffffffffffff4)

QEMU's constrained emulated address space can't host libasan's fixed 64-bit allocator region, so the mmap returns -ENOMEM (0xfffffffffffffff4 == -12). That failing test is why ASan was disabled on arm64 via NO_SANITIZERS=2 (noasan_fallback_platforms).

Side note: the -DSANITIZER_CAN_USE_ALLOCATOR64=0 workaround in the Makefile was a no-op — that define only takes effect when libasan itself is compiled, not the application (hence the "But this doesn't work!" comment). Those dead blocks are removed.

Fix

Build and test aarch64 on native ubuntu-24.04-arm runners (free for public repos, GA Aug 2025) instead of under QEMU. On real hardware ASan initialises normally, so linux/arm64/v8 is dropped from noasan_fallback_platforms and ships with ASan again (ubuntu + debian). No ASLR/security tradeoff and no change to what's shipped beyond re-enabling ASan.

Changes

• publish_docker_matrix_base.yml — route linux/arm64/v8 to ubuntu-24.04-arm (everything else stays on the amd64 runner + QEMU); add a CI-only sysctl vm.mmap_rnd_bits=28 before the arm64 test as cheap insurance in case a base image ever ships a pre-LLVM-17 libasan (GCC ≤13).
• publish_docker_matrix_all.yml — remove linux/arm64/v8 from noasan_fallback_platforms for ubuntu + debian; narrow the *AsanTest canaries to the platforms still under QEMU (armv7, ppc64le).
• Makefile — delete the dead SANITIZER_CAN_USE_ALLOCATOR64=0 blocks and document the actual cause/fix.

armv7 and ppc64le stay on the QEMU fallback (NO_SANITIZERS=2); the AsanTest canary jobs keep probing them.

Notes / validation

• Reproduced locally on native arm64 (Docker, Apple Silicon): a clean ASan binary on the current ubuntu:latest/debian:latest toolchains starts fine even at vm.mmap_rnd_bits=32; under QEMU it aborts with the issue's CHECK — consistent with the diagnosis.
• This PR's own CI runs the arm64 build + docker run test on the native runner (the PR build path loads the image locally and skips push/merge), so the green/red result here directly validates that ASan works on arm64.
• Rollback if ever needed is one line: re-add "linux/arm64/v8" to noasan_fallback_platforms.