Static analysis and sanitizer gates
===================================

Pull requests always run Ruff 0.12.8 over ``python/mspasspy`` and
``python/tests`` with ``E9,F63,F7,F82`` selected.  Pull requests that change
``cxx/**`` additionally run the complete native CTest suite in separate ASan
and UBSan builds.  The stable ``static-gates`` job accepts only successful
applicable jobs or two skipped sanitizer jobs when no native path changed.

Branch protection must not require ``static-gates`` until this workflow has
been merged into ``master`` and produced the check there.  Configuring it
earlier could leave pull requests waiting for a context that the base branch
cannot create.  After a successful run on ``master``, a repository
administrator should add exactly ``static-gates`` to the required status
checks and confirm it through the branch-protection API.