1. 1. What

Changes the zstd entry in `etc/tsan.suppressions` from `called_from_lib:libzstd.so` to `called_from_lib:libzstd.so$`.

1. 1. Why

SERVER-133486 added `called_from_lib:libzstd.so` to stop a mongod shutdown deadlock under TSAN. That pattern is matched as a substring against every loaded module's full path, and TSAN requires a `called_from_lib` pattern to resolve to exactly one module — if it matches two, `LibIgnore::OnLibraryLoaded` reports and calls `Die()`.

The antithesis images have two:

• `/usr/bin/../lib/libzstd.so` — our own zstd, built from `src/third_party/zstandard` and installed to `/usr/lib` by `buildscripts/antithesis/base_images/mongo_binaries/Dockerfile`
• `/lib/x86_64-linux-gnu/libzstd.so.1` — the distro copy, pulled in transitively by the apt packages in the base image

The two coexist because their SONAMEs differ, so the loader doesn't dedupe them. Both match `libzstd.so`, so TSAN aborted every binary at startup. That failed `RUN /usr/bin/mongo --version` at Dockerfile:63 with exit 134 and system-failed all 16 antithesis tasks on `enterprise-ubuntu2204-64-tsan-libvoidstar` (BF-45741, 94 BFGs since 2026-08-18).

Other TSAN variants were unaffected: they don't have a second libzstd mapped, so the pattern already resolved uniquely there.

1. 1. How

`$` anchors the match to end-of-path, so `libzstd.so$` matches our `.../lib/libzstd.so` and not the distro's `...libzstd.so.1`. Exactly one module matches, no `Die()`, and the suppression keeps muting analysis inside the same library as before — the one WiredTiger's block compressor calls into on the deadlock path.

1. 1. Safety

• Behavior on non-antithesis TSAN variants is unchanged: the same single module matched before and matches now.
• No effect on non-sanitizer builds.
• Narrowing risk is fail-soft, not fail-hard: a `called_from_lib` pattern that matches zero libraries is not an error, so the worst case on a variant whose zstd path is spelled differently is losing the suppression, not an abort.
• Comment added above the line recording that the anchor is load bearing, so it isn't dropped as cosmetic later.

1. 1. Testing

Evergreen patch: https://spruce.corp.mongodb.com/version/6a8c7886dbafff00073a324a

• `antithesis_replica_sets_jscore_passthrough` on `enterprise-ubuntu2204-64-tsan-libvoidstar` — *success*. Builds and pushes the mongo-binaries image, so it executed the `mongo --version` verification step that was aborting.
• `jsCore` on `enterprise-rhel8-debug-tsan` — *success*, 7529 tests, 0 failed. No regression on the variant SERVER-133486 targeted.

Not covered: these runs confirm the suppression doesn't abort, but not that it still matches on rhel8 — TSAN only logs a successful `called_from_lib` match at `verbosity=1`, and a zero-match suppression is silent. Reasoning says it matches (rhel8-debug-tsan runs out of `dist-test`, so the path ends in `.../dist-test/lib/libzstd.so`), and I'll confirm with a `verbosity=1` run before this leaves draft.