CI: Add Clang Static Analyzer

[jserv]

This integrates scan-build into GitHub Actions:

• Standard checkers as a blocking gate (--status-bugs)
• Alpha checkers as non-blocking informational reporting
• Extract setup_llvm_repo() in install-deps.sh to share LLVM 20 APT repository setup between format and analysis modes
• Upload HTML scan-build reports as artifacts on failure

---

Summary by cubic

Adds Clang Static Analyzer (scan-build) to CI as a blocking check, with alpha checkers reported as non-blocking; includes small const-correctness and safety fixes uncovered by analysis.

• New Features

  • Adds static-analysis job to GitHub Actions (Ubuntu 24.04) using scan-build-20 with --status-bugs.
  • Runs alpha checkers as informational and posts a notice with counts.
  • Uploads HTML scan-build reports as artifacts on failure.
  • Extends .ci/install-deps.sh with analysis mode and shared setup_llvm_repo() for LLVM 20.

• Bug Fixes

  • Corrects word-left cursor movement in text fields (uses the right previous index).
  • Sets side sheet elevation to IUI_ELEVATION_2 when modal.
  • Const-correct APIs and internals (e.g., iui_table_end, nav_end, bottom_sheet_end, bottom_app_bar; headless framebuffer size; various tests).
  • Introduces IUI_ASSERT to avoid Clang Analyzer false positives while keeping debug asserts.
  • Minor cleanups: tighter variable scopes, const arrays, static linkage for internal helpers.

^{Written for commit 9889ddf. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 24 files