New CI workflows

[rileyjmurray]

This PR brought to you by a robot.

Replaces the four legacy workflows with a single matrix workflow plus dedicated workflows for ThreadSanitizer, examples, downstream-consumer smoke, and docs. Adds a Docker dev image for running TSan locally on Apple Silicon. Raises the documented minimum compiler floor.

New workflows

• core.yml — single matrix replacing four legacy files. 11 cells: Linux gcc/clang × OpenBLAS/MKL × Release/Debug × {none, ASan, UBSan}; macOS 14 Apple Clang (serial) + Homebrew LLVM (OpenMP) × Accelerate × {none, ASan}; macOS 15 Homebrew LLVM tracking the latest runner.
  • All OpenMP cells run ctest twice — OMP_NUM_THREADS=1 and =4 — so the thread-independence invariant is actually exercised, not just compiled.
  • OpenBLAS and MKL are tested in separate Linux builds, so the RandBLAS_HAS_MKL codepaths get real coverage instead of "whichever blaspp happened to pick."
• thread-sanitizer.yml — clang + libomp + -fsanitize=thread on Linux. Defends the thread-independence invariant on the RNG state machinery that ASan can't catch.
• examples.yml — builds examples/ against an installed RandBLAS (with lapackpp from the composite action). Catches downstream API drift in real consumer code.
• downstream-consumer.yml + test/downstream/ — find_package(RandBLAS) from a tiny isolated consumer. Guards the install/export rules in RandBLAS/CMakeLists.txt.
• docs.yml — doxygen + sphinx-build. Shadow build for now (no -W) — follow-up after the docstring warning backlog is cleared.
• .github/actions/setup-randblas-deps/ — composite action installing system deps and building blaspp + Random123 (+ optionally lapackpp), cached on upstream commit SHA. Eliminates the heavy copy-paste across the old workflows.

Removed

• The four legacy workflows (core-linux.yaml, core-macos.yml, openmp-macos.yaml, openmp-macos-15.yaml). The last two were converging to the same job once macos-latest rolls to 15.

Local TSan tooling

• docker/tsan/Dockerfile + run.sh — Linux container with clang + libomp + sanitizer runtimes + llvm-symbolizer + baked blaspp/Random123. Necessary because TSan can't run natively on Apple Silicon (shadow-memory mapping fails at startup before TSan can even print its banner). Usage:
  • ./docker/tsan/run.sh build-and-test — full TSan ctest pass in one shot.
  • ./docker/tsan/run.sh — interactive shell for iteration.
  • ./docker/tsan/run.sh rebuild-image — refresh blaspp / Random123 upstream.

Hygiene

• actions/checkout@v4 everywhere (three of four legacy files were on deprecated @v2).
• concurrency: group with cancel-in-progress: true so superseded PR runs auto-cancel.
• push: branches: [main] trigger so main's CI status reflects current state, not just the merge-time check.
• make -j$(nproc) / sysctl -n hw.logicalcpu instead of -j2.
• blaspp / lapackpp / Random123 builds cached, keyed on upstream commit SHA.

Doc updates

• CLAUDE.md and INSTALL.md: documented minimum compiler raised gcc-9 → gcc-13 to match ubuntu-latest. Old gcc-8.5 / -fconcepts workaround note removed.

Explicitly not in this PR

• Windows / MSVC — out of scope.
• gcc-9 cell — dropped in favor of raising the documented floor.
• -W on docs — deferred until the docstring warning baseline is clean.
• GCC-on-macOS cell — easy follow-up if needed.

Verification

• All 11 core.yml cells green on this branch.
• thread-sanitizer.yml: locally green via docker/tsan/run.sh build-and-test. Instrumentation verified end-to-end by planting a deliberate harmless race in dense_skops.hh and confirming TSan caught it, then reverting — so the clean baseline isn't a green-because-everything-is-suppressed.
• examples.yml and downstream-consumer.yml re-pointed at the new CMake config layout from CMake improvements #169 (<prefix>/lib/cmake/RandBLAS/) and switched to -DCMAKE_PREFIX_PATH=<prefix> per the new INSTALL.md recommendation, so the same class of layout-change breakage can't recur.