The with_mongot_extension_ and concurrency_with_mongot_extension_ task families only run on the two AL2023 mongot-integration-extensions-secure variants. No sanitizer variant runs them, so we have no memory-safety or UB coverage of the server<->mongot-extension integration.

Proposal

Add an {A,UB}SAN build variant that compiles with -config=dbg_aubsan plus -//bazel/config:extensions_signature_verification_secure=True (required: these suites load the production-signed extension, which only a secure-mode server can verify) and runs the .extensions_secure_mode tasks nightly.

Coverage

The published extension .so is not instrumented, so this covers all host-side extension code, plus extension-side leaks and invalid/double frees via ASAN's allocator interposition (leak detection stays fully enabled; only triaged benign-by-design shutdown leaks get suppressed, and those get reported upstream). UB and bad accesses inside extension code itself are out of scope.