Add tsan sanitizer

[VukPavicRTRK]

Description

Integrates ThreadSanitizer (TSan) via score_cpp_policies' shared sanitizer infrastructure, completing the sanitizer rollout started in the earlier ASan/UBSan/LSan PR.

Changes

• .bazelrc

  • Adds --config=tsan (-fsanitize=thread, -O1, -Wno-tsan)
  • Reuses with_debug_symbols
  • Runs tests via //tools/sanitizers:tsan_setarch_wrapper

• tools/sanitizers/*

  • Adds a wrapper that runs tests under setarch -R to disable ASLR per test

• .github/workflows/sanitizers.yml

  • Adds tsan to the sanitizer matrix
  • Removes the global ASLR workaround

• README.md

  • Documents running TSan locally

• Test exclusions

  • Tags Rust-linked tests, process_state_client_ut, and integration tests no-tsan

Notes

TSan requires ASLR to be disabled for its shadow memory layout. This is handled automatically via --run_under, so no host configuration changes are needed in CI or locally.

Running locally

bazel test --config=tsan --config=x86_64-linux //score/... //tests/...

Closes #233

[github-actions]

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.4.2) and connecting to it...
INFO: Invocation ID: 0d2dc37c-4412-438f-9eff-eca2ccdecb2d
Computing main repo mapping: 
Computing main repo mapping: 
Loading: 
Loading: 0 packages loaded
Loading: 0 packages loaded
Loading: 0 packages loaded
    currently loading: 
Loading: 0 packages loaded
    currently loading: 
Loading: 0 packages loaded
    currently loading: 
Analyzing: target //:license-check (1 packages loaded, 0 targets configured)
Analyzing: target //:license-check (1 packages loaded, 0 targets configured)

Analyzing: target //:license-check (20 packages loaded, 10 targets configured)

Analyzing: target //:license-check (79 packages loaded, 10 targets configured)

Analyzing: target //:license-check (138 packages loaded, 1631 targets configured)

Analyzing: target //:license-check (150 packages loaded, 5404 targets configured)

Analyzing: target //:license-check (155 packages loaded, 5453 targets configured)

Analyzing: target //:license-check (157 packages loaded, 7914 targets configured)

Analyzing: target //:license-check (162 packages loaded, 10142 targets configured)

Analyzing: target //:license-check (162 packages loaded, 10142 targets configured)

INFO: Analyzed target //:license-check (163 packages loaded, 10268 targets configured).
[12 / 16] JavaToolchainCompileClasses external/rules_java+/toolchains/platformclasspath_classes; 0s disk-cache, processwrapper-sandbox ... (2 actions running)
[14 / 16] JavaToolchainCompileBootClasspath external/rules_java+/toolchains/platformclasspath.jar; 0s disk-cache, processwrapper-sandbox
INFO: Found 1 target...
Target //:license.check.license_check up-to-date:
  bazel-bin/license.check.license_check
  bazel-bin/license.check.license_check.jar
INFO: Elapsed time: 22.328s, Critical Path: 2.49s
INFO: 16 processes: 12 internal, 3 processwrapper-sandbox, 1 worker.
INFO: Build completed successfully, 16 total actions
INFO: Running command line: bazel-bin/license.check.license_check ./formatted.txt <args omitted>
usage: org.eclipse.dash.licenses.cli.Main [-batch <int>] [-cd <url>]
       [-confidence <int>] [-ef <url>] [-excludeSources <sources>] [-help] [-lic
       <url>] [-project <shortname>] [-repo <url>] [-review] [-summary <file>]
       [-timeout <seconds>] [-token <token>]

[github-actions]

The created documentation from the pull request is available at: docu-html

[NicolasFussberger]

I really appreciate your effort to narrow the scope of ASLR disabling just for the test run.
Does this binary need to be public or can this stay repo-private?