CI: container fixes for sanitizer/ibmswtpm/multi-compiler

- Image: add libclang-rt-18-dev so clang -fsanitize=* can link (compiler-rt
  is only a Recommends of clang and was dropped by --no-install-recommends),
  and add zip (an example loads /usr/bin/zip as sample data).
- ibmswtpm-tpm2tools: start tpm_server in the same step as the test; GitHub
  reaps a step's background processes between steps in container jobs.
- multi-compiler: raise the 5-minute job timeout to 12 so an occasionally
  slow apt mirror installing a version-specific compiler is not hard-cancelled.

.github/docker/wolftpm-ci/Dockerfile

@@ -24,6 +24,7 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
     cmake \
     git \
     iproute2 \
+    libclang-rt-18-dev \
     libssl-dev \
     libtool \
     libtss2-tcti-mssim0 \
@@ -32,4 +33,5 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
     sudo \
     tpm2-tools \
     valgrind \
+    zip \
     && rm -rf /var/lib/apt/lists/*

.github/workflows/fwtpm-test.yml

@@ -328,22 +328,19 @@ jobs:
           # transient salt keys for HMAC sessions which consume extra slots
           max-loaded-objects: 7
 
-      - name: Start IBM SW TPM
+      # Start the simulator and run the tests in one step: GitHub reaps a
+      # step's background processes between steps in container jobs, so a
+      # server started in a separate step would be gone by the test step.
+      - name: Run tpm2-tools tests
         run: |
           ibmswtpm2/src/tpm_server &
-          echo $! > /tmp/tpm_server.pid
+          TPM_PID=$!
           sleep 1
-          kill -0 $(cat /tmp/tpm_server.pid)
-
-      - name: Run tpm2-tools tests
-        run: scripts/tpm2_tools_test.sh --no-start
-
-      - name: Stop IBM SW TPM
-        if: always()
-        run: |
-          if [ -f /tmp/tpm_server.pid ]; then
-            kill $(cat /tmp/tpm_server.pid) 2>/dev/null || true
-          fi
+          kill -0 "$TPM_PID"
+          scripts/tpm2_tools_test.sh --no-start
+          rc=$?
+          kill "$TPM_PID" 2>/dev/null || true
+          exit $rc
 
   # ----------------------------------------------------------------
   # fwTPM STM32 emulator test (m33mu Cortex-M33 simulator)

.github/workflows/multi-compiler.yml

@@ -69,7 +69,9 @@ jobs:
     name: ${{ matrix.cc }}
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    # Headroom for an occasionally-slow apt mirror installing a version-specific
+    # compiler (apt-retry handles real failures; this avoids a hard cancel).
+    timeout-minutes: 12
     needs: build_wolfssl
     strategy:
       fail-fast: false