ci: detach PR benchmark reports from head checks

[kryptt]

Outcome

Run A/B benchmarks separately from the PR head and post an informational sticky comment, without a long-running benchmark check on the PR revision.

Changes

• Trigger from successful PR Continuous Integration using workflow_run on the default branch.
• Separate trusted planning and comment publication from read-only same-VM benchmark execution.
• Pin immutable head/merge-base SHAs; reject forks, closed PRs, ambiguous matches, and stale heads.
• Restore caches only; never save PR-generated contents into the default-branch cache namespace.
• Keep manual PR reruns and default-branch A/A calibration; calibrated allocation regressions warn in the comment rather than gate merging.
• Document activation and rerun commands.

Verification

• 49 stdlib Python unit tests passed.
• Seven smoke scenarios executed the production report-rendering shell step: success, threshold breach, base/head/setup failures, missing artifact, malformed JSON.
• actionlint workflow/expression validation, mapping validation, and git diff --check passed.

Activation

The workflow_run trigger becomes active once this PR lands on main. A live Actions smoke run follows landing.

[github-actions]

🚀 Cloudflare Pages preview for ci/detach-pr-benchmarks is live:

https://5cbe02d2.cats-eo-docs.pages.dev

Branch alias: https://ci-detach-pr-benchmarks.cats-eo-docs.pages.dev

_{Built from commit e210451a4b77c404a88f5075b06b4b018b602a55 · updated on every push.}