Move CI static analysis and sanitizers to LLVM 22 and add an opt-in clang-tidy pre-commit hook

[philipcraig]

Summary

• Move the clang-tidy pin from LLVM 21 to 22 in every place it lives: the Clang Tidy and IWYU workflows, docker/Dockerfile (clang-tidy-22 + clang-tidy symlink), and cmake/modules/FindClangTidy.cmake (prefers clang-tidy-22, warns on a major-version mismatch with CI).
• Add Clang-22 (C++20 and C++23) entries to the cmake.yml build matrix, and fix the Clang-20 entry, which asked setup-clang for version 19 and only worked because the runner image already ships clang-20.
• Bump google benchmark v1.9.1 → v1.9.5. Clang 22 warns that __COUNTER__ is a C2y extension (-Wc2y-extensions), and benchmark compiles its own sources with -Werror -pedantic-errors, so v1.9.1 failed to build in the new Clang-22 jobs. v1.9.5 suppresses the warning around its __COUNTER__ probe.
• Add a manual-stage pre-commit hook clang-tidy that runs ./scripts/cmake.sh --debug --clang-tidy, invoked with uv run pre-commit run --hook-stage manual clang-tidy. It is skipped by the default pre-commit run --all-files, so the pre-commit CI job is unaffected.
• Run the sanitizer jobs (asan+ubsan, tsan, msan) with Clang 22 instead of 19.
• Document the above in CONTRIBUTING.md.

Why

.clang-tidy already disables cppcoreguidelines-pro-bounds-avoid-unchecked-container-access, which only exists in clang-tidy 22, and clang-format is pinned to 22, while CI analysed with 21. clang-tidy silently ignores unknown check names, so nothing broke, but local and CI runs used different check sets.

Test plan

• uv run pre-commit validate-config and uv run pre-commit run --all-files pass; the clang-tidy hook is not run at the default stage.
• uv run pre-commit run --hook-stage manual clang-tidy runs the full build.
• FindClangTidy.cmake version warning verified with a stub clang-tidy reporting 21.1.6.
• Local ./scripts/cmake.sh --debug --clean with benchmark v1.9.5: 87/87 tests pass.
• Clang Tidy workflow passes on LLVM 22 with zero new findings.
• IWYU workflow builds from the clang_22 branch and passes.
• New Clang-22 matrix jobs pass (they failed on v1.9.1 before the benchmark bump).
• Clang-20 matrix jobs pass with Clang 20 actually installed.
• Sanitizer jobs (asan+ubsan, tsan, msan) pass on Clang 22.
• docker/Dockerfile change verified in a rebuilt Codespace: clang-tidy resolves to clang-tidy-22 (LLVM 22.1.2), CMake selects it with no version warning, the manual hook passes on a clean build, and an injected in-tree finding is rejected.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QHjiPBayDu7hLZyhcQK3tt

[jbcoe]

This looks great. 😊