fix: Switch GCC ASAN to -mcmodel=medium and reduce TSAN build parallelism

- Change -mcmodel=large to -mcmodel=medium for GCC ASAN builds. The large
  model inflates code size with 64-bit absolute addresses, pushing the
  binary past the 2GB limit where GCC's pre-compiled CRT startup code
  (crtstuff.c) can't reach data sections with 32-bit relocations.
  Medium model keeps code compact (CRT-compatible) while allowing data
  beyond 2GB.

- Add nproc_subtract=20 for TSAN builds to reduce build parallelism.
  TSAN instrumentation significantly increases per-compilation-unit memory
  usage, causing OOM on CI runners with high parallelism.

- Plumb nproc_subtract from the CI matrix through to the build workflow
  so individual configurations can control their parallelism.

- Temporarily restrict CI matrix to only the two previously-failing
  configs (gcc-13 asan-ubsan, clang-20 tsan-ubsan) to validate fixes
  without burning CI resources on passing configs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/scripts/strategy-matrix/generate.py

@@ -256,6 +256,8 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
                 }
             )
             # Add TSAN + UBSAN configuration.
+            # TSAN instrumentation significantly increases memory usage during
+            # compilation, so reduce build parallelism to avoid OOM on CI runners.
             configurations.append(
                 {
                     "config_name": config_name + "-tsan-ubsan",
@@ -266,6 +268,7 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
                     "os": os,
                     "architecture": architecture,
                     "sanitizers": "thread,undefinedbehavior",
+                    "nproc_subtract": 20,
                 }
             )
         else:
@@ -282,6 +285,20 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
                 }
             )
 
+    # TEMPORARY: Only build previously-failing sanitizer variants to save CI.
+    # Remove this filter once these configs pass.
+    sanitizer_only = [
+        c
+        for c in configurations
+        if c["sanitizers"]
+        and (
+            ("gcc-13" in c["config_name"] and "asan" in c["config_name"])
+            or ("clang-20" in c["config_name"] and "tsan" in c["config_name"])
+        )
+    ]
+    if sanitizer_only:
+        return sanitizer_only
+
     return configurations