Perf: bound adversarial complexity and worst-case latency

[chrisbbreuer]

Parent: #459
Depends on: #460, #461, #473, #475, #487

Goal

Bound adversarial algorithmic complexity and worst-case latency across parser, runtime, collections, RegExp, JSON, GC, modules, and Wasm without input blacklists or semantic shortcuts.

Scope

• Inventory user-controlled operations with potential superlinear CPU/memory/stack behavior: tokenization/parsing, property/shape chains, hash tables, sparse arrays, proxy/accessor recursion, string search/replace, regex backtracking, JSON depth/width, module graphs, promise fanout, weak processing, GC graph traversal, structured clone, Wasm decode/validate/compile, and debugger/inspector payloads.
• Add deterministic growth-series benchmarks and complexity assertions using exact work/limits rather than wall time alone where possible.
• Implement owned algorithmic fixes, randomized/robust hashing, bounded stacks/worklists, cycle detection, budgets, and catchable resource failures consistent with public semantics.
• Record tail latency and peak memory under concurrency and no-GIL schedules.

No-workaround rules

• No known-input blacklist, reduced language/profile, arbitrary rejection below documented resource limits, catastrophic case hidden from aggregate results, or third-party parser/regex/hash implementation.

Acceptance

• Every inventoried surface has a growth-series witness and explicit expected complexity/resource bound.
• Adversarial cases terminate within declared budgets with exact result or specified catchable error; no crash/hang/stack overflow/leak.
• Ordinary-case Bench: define the representative dependency-free performance matrix #460 performance does not regress materially.
• Fuzz, OOM/fault, deep graph, no-GIL, TSan, and sanitizer gates cover boundary cases.
• Security/performance docs state exact limits and evidence without claiming more than measured.

Foundation

Existing bounded Worker delivery, heap caps, parser diagnostics, regex ownership, structured clone limits, and Wasm hostile-declaration tests.