CI: add a zlib leg to the extensions job so the real DEFLATE codecs run in CI

[InauguralPhysicist]

#693 (#684) added the DEFLATE codecs behind EIGENSCRIPT_EXT_ZLIB (make zlib). The suite's [124] section is probe-gated: on the minimal build it only checks the "compiled without zlib support" stub, so the 22 real-codec checks in tests/test_inflate.eigs never execute in CI — they were verified locally (release + ASan/UBSan zlib builds, all pass) at merge time, but nothing guards them against regression.

The extensions job in .github/workflows/ci.yml already has the exact pattern (build variant → run full suite, see the make http / make gfx legs). Definition of done:

• A make zlib build step + full-suite run in the extensions job (or a variant-matrix entry), executing suite section [124] for real (the job log shows "DEFLATE Codecs (runtime: DEFLATE inflate (zlib) for reading compressed archives (.xlsx, .ods, .gz) #684, 22 checks)" instead of the stub check)
• zlib1g-dev present in the dev/CI image if it isn't already (check .devcontainer/)
• Consider an ASan pass over the zlib build if cheap (the codec path is untested under sanitizers in CI otherwise)

Run the DoD's assertions locally before opening the PR: make zlib && cd tests && bash run_all_tests.sh should show the 22-check section.

[InauguralPhysicist]

Done in #700 — the extensions job now builds make zlib and runs the full suite against it, so section [124] executes the 22 real-codec checks instead of the stub, and zlib1g-dev is in the devcontainer image. The optional ASan-over-zlib item is left unclaimed; file it separately if it's wanted.