v9: Major rework

.github/workflows/bench.yml

@@ -0,0 +1,63 @@
+# Benchmarks (Deliverable 13). A dedicated workflow rather than a job in
+# ci.yml, because the nightly `schedule` trigger would wake every job in
+# that file; here it wakes exactly this one.
+#
+# Posture: INFORMATIONAL. `continue-on-error: true` means this job cannot
+# fail a build, and that is deliberate — the D11 precedent (sqlcipher is
+# post-merge-only so an apt hiccup cannot gate every push) applies more
+# strongly here: timing on shared GitHub runners is noisier than apt, and
+# a flaky gate is worse than an ungated check. The gate itself still
+# exists and still reports: bench:compare exits 2 on a >10% median
+# regression, the per-case verdicts are in the log, and the JSON is
+# uploaded as an artifact so a regression can be promoted into
+# bench/baseline.json deliberately (`--baseline-from`). Local runs on a
+# quiet machine are the enforceable gate.
+#
+# Runner: ubuntu-22.04 is a pinned label (ubuntu-latest floats across a
+# mixed pool — results from a mixed pool are noise). Node is pinned to 24
+# to match the environment the committed baselines were captured on.
+name: bench
+on:
+  workflow_dispatch:
+  schedule:
+    # Nightly at 03:07 UTC — off the top of the hour, when runner
+    # contention from everyone else's cron spikes.
+    - cron: '7 3 * * *'
+  push:
+    branches:
+      - 'release/*'
+
+jobs:
+  bench:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 40
+    # Informational: see the workflow header. A red bench job annotates
+    # and uploads; it cannot block a merge or a publish.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86  # v6.0.10
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version: 24
+          scope: '@appthreat'
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: '3.12'
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Rebuild native module (required after --ignore-scripts)
+        run: pnpm run rebuild
+      # RME gate + baseline comparison. On a shared runner expect some
+      # REJECTED cases; that is the harness refusing to report noise, not
+      # a failure. The verdict lines and the exit code land in the log.
+      - name: Run benchmarks and compare against baseline
+        run: pnpm run bench:compare --json bench-results.json
+      - name: Upload bench results
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: bench-results-${{ github.sha }}
+          path: bench-results.json