* harden security-sensitive input handling * enable ctest failure checks in ci * add valgrind leak smoke tests * split tests into separate workflow