Library callback trap leaks the final bytes argument under ASan on Linux

Summary

The library host-callback ASan test exits with LeakSanitizer errors for both C and LLVM emission on Linux. The happy-path probe eventually clears emitChunk, calls cb_stream, and recovers from the resulting SC4025 trap through the panic sink's supported longjmp path. The final bytes argument allocated for that call is not released.

This reproduces on current main at 73efea6ab38cfa8e63e15a66d28d279e3f17a2a7.

Reproduction

pnpm install --frozen-lockfile
pnpm -r build
SCRIPTC_NO_CACHE=1 pnpm vitest run tests/harness/library-callbacks.test.ts \
  -t "CB8: CB1/CB2 under ASan"

Both parameterized cases fail at tests/harness/library-callbacks.test.ts:455 because the probe exits with status 1 instead of 0.

LeakSanitizer output

Both backends report the same allocation path:

Direct leak of 40 byte(s) in 1 object(s) allocated from:
  malloc
  scr_bytes_new
  cb_stream

Indirect leak of 3 byte(s) in 1 object(s) allocated from:
  calloc
  scr_bytes_new
  cb_stream

SUMMARY: AddressSanitizer: 43 byte(s) leaked in 2 allocation(s).

As a control, disabling leak detection leaves the rest of the contract green:

ASAN_OPTIONS=detect_leaks=0 SCRIPTC_NO_CACHE=1 \
  pnpm vitest run tests/harness/library-callbacks.test.ts \
  -t "CB8: CB1/CB2 under ASan"

Result: 2 passed, 28 skipped.

Environment

• CachyOS Linux x86_64
• Clang 22.1.8
• Node 24.15.0
• pnpm 11.15.1

The current hosted run for this exact revision is green, but the complete plain/sanitized suites run on macOS; the Linux job only runs the host-clang static-build regression: https://github.com/vercel-labs/scriptc/actions/runs/33105203824

Read tests/harness/library-callbacks.test.ts around line 455 and trace the cb_stream allocation path through the panic sink's supported longjmp path after emitChunk is cleared. Reproduce the CB8: CB1/CB2 under ASan test for both C and LLVM emission. Done means both cases pass with leak detection enabled and no LeakSanitizer errors remain.