tsan: investigate and fix TSAN failure for createJsonFormatter StatusOr change

[Copilot]

Context

PR #45831 changes SubstitutionFormatStringUtils::createJsonFormatter return type from FormatterPtr to absl::StatusOr<FormatterPtr>, and the TSAN CI job failed during that run (exit code 3 — test failure, not build failure).

Investigation

The session exhausted quota before a conclusive root cause was identified or a code fix implemented. Key findings from the analysis:

• CI artifacts were inaccessible: Job 83338832915 logs only showed post-processing tail; the ci-report-tsan.json artifact contained only disk usage stats; the EngFlow BES invocation URL was not reachable externally.
• Two concurrent changes are in scope: The PR's formatter StatusOr changes and the TLS read_disabled_ logic introduced in main at df2c77d (tls: fix connection close detection while handshake is waiting), which ships a new AsyncCertSelectionCancellationObservedOnDownstreamClose integration test.
• ASAN passed / TSAN failed: This is characteristic of a data race, not a memory safety issue — pointing away from the formatter change itself.
• Prime suspect: CancellableSelectionHandle destructor in async_cert_selector.h holds an Event::TimerPtr and CertificateSelectionCallbackPtr; if destroyed off the dispatcher thread (e.g., when the downstream connection closes and tears down SslExtendedSocketInfoImpl), TSAN would flag it as a data race.

Status

⚠️ Incomplete — no code changes were committed. Further work is needed to:

1. Retrieve the actual TSAN report (stack traces) from a fresh CI run
2. Confirm the CancellableSelectionHandle destruction threading hypothesis
3. Implement the fix (likely ensuring cert-selector handle destruction is posted back to the dispatcher thread, or guarding access with appropriate synchronization)

[repokitteh-read-only]

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #45836 was opened by Copilot.

see: more, trace.